Plugins: Windows.string speed enhancements by eve #1882
Conversation
ikelos
force-pushed
the
feature/eve-string-speedup
branch
from
56d28e7 to
4f7f3ad
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| strings_fp = resources.ResourceAccessor().open( | ||
| self.config["strings_file"], "rb" | ||
| ) |
Check warning
Code scanning / CodeQL
File is not always closed Warning
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 23 days ago
To fix this problem, we should ensure that the opened file is always closed, even if exceptions are raised during file processing. The best way to do this in Python is to use a with statement, which guarantees that the file is closed when the block is exited. Specifically, the assignment to strings_fp and all usages of strings_fp should be indented under a with block, replacing:
strings_fp = resources.ResourceAccessor().open(self.config["strings_file"], "rb")
line = strings_fp.readline()
...
line = strings_fp.readline()with
with resources.ResourceAccessor().open(self.config["strings_file"], "rb") as strings_fp:
line = strings_fp.readline()
...
line = strings_fp.readline()No external libraries are necessary for this fix. The only modification is to wrap the code that uses the file handle in a with block, ensuring the file is always closed.
| @@ -115,19 +115,19 @@ | ||
| string_list: list[tuple[int, bytes]] = [] | ||
|
|
||
| # Test strings file format is accurate | ||
| strings_fp = resources.ResourceAccessor().open( | ||
| with resources.ResourceAccessor().open( | ||
| self.config["strings_file"], "rb" | ||
| ) | ||
| line = strings_fp.readline() | ||
| count: float = 0 | ||
| while line: | ||
| count += 1 | ||
| try: | ||
| offset, string = self._parse_line(line) | ||
| string_list.append((offset, string)) | ||
| except ValueError: | ||
| vollog.error(f"Line in unrecognized format: line {count}") | ||
| ) as strings_fp: | ||
| line = strings_fp.readline() | ||
| count: float = 0 | ||
| while line: | ||
| count += 1 | ||
| try: | ||
| offset, string = self._parse_line(line) | ||
| string_list.append((offset, string)) | ||
| except ValueError: | ||
| vollog.error(f"Line in unrecognized format: line {count}") | ||
| line = strings_fp.readline() | ||
| kernel = self.context.modules[self.config["kernel"]] | ||
|
|
||
| revmap_tree = self.generate_mapping( |
| line_count: float = 0 | ||
| num_strings = len(string_list) | ||
| for offset, string in string_list: | ||
| _num_strings = len(string_list) |
Check notice
Code scanning / CodeQL
Unused local variable Note
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 23 days ago
The best way to fix the problem is to remove the unused assignment to _num_strings. This can be achieved by deleting the line that assigns len(string_list) to _num_strings (line 143). This change is safe because the result of len(string_list) is not used and the call to len() has no side effect, so nothing in the function's behavior is altered. No additional imports, methods, or other code changes are required.
| @@ -140,7 +140,6 @@ | ||
|
|
||
| _last_prog: float = 0 | ||
| line_count: float = 0 | ||
| _num_strings = len(string_list) | ||
|
|
||
| for phys_offset, string in string_list: | ||
| line_count += 1 |
This should have a much faster string searching mechanism (see #876 and #1043). If only we can get a little native interval-tree structure working...