Skip to content

Introduce parsers - #1

Open
jozef-sabo wants to merge 14 commits into
laciKE:masterfrom
jozef-sabo:feature-new-parsers
Open

jozef-sabo wants to merge 14 commits into
laciKE:masterfrom
jozef-sabo:feature-new-parsers

Conversation

@jozef-sabo

@jozef-sabo jozef-sabo commented Apr 3, 2025

Copy link
Copy Markdown

Reformat ESET virlog.dat fields extractor to an actual parser.

Add new NDF parser.

@laciKE

laciKE commented Apr 3, 2025

Copy link
Copy Markdown
Owner

Hello, thank you for your pull request. I am happy to see new commits here and that you have brought attention to the another file format :-)

Couple of notes from my side:

  • New requirement of kaitai - while kaitai is a great tool for analysis of file formats, I would like to keep this EsetLogParses without dependencies on non-standard python modules.
  • My original intention was to keep it simple for deployment and usage, just one script without dependencies - after years, it is lot of pain to setup and run old forensic tools, especially if they have incompatible dependencies.
  • Usage has changed. Based on readme, in this pull request there is a parameter --type virlog for parsing virlog files. However, as I found, during the years somehow happened that this tool is used by several other tools and could be part of the automation - so I would like to avoid breaking changes in its usage unless necessary.

What do you think? Is it worth rewriting the proposed changes and support for NDF files to pure python code without kaitai?

And finally, I am just curious... is it related to your bachelor thesis or some school project? ;-)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants