sfx: false positives

[ElDavoo]

FACT version

latest commit

Environment

ubuntu noble in docker, https://github.com/ElDavoo/FACT_docker

Steps to reproduce

1. Analyze a MIPS firmware (I'm using tp-link archer c6 v2 as an example) with cwe_checker

Observed Behavior

Many useless extraction happens, many plugins run on it, most of all cwe_checker that fails and pollutes the logs

Expeced Behavior

Not extracting normal binaries

Installation logs

install.log

PASTE HERE

Backend logs

fact_main_backend.log

No logs, so output of unpacker plugin of a binary copy-pasted from the web UI:

Plugin Version 	0.1
Plugin 	SFX
Extracted 	5
Output 	

7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
p7zip Version 16.02 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,16 CPUs Intel(R) Xeon(R) Gold 6252N CPU @ 2.30GHz (50657),ASM,AES-NI)

Scanning the drive for archives:
1 file, 4293 bytes (5 KiB)

Extracting archive: /tmp/extractor/tmpu_d9bvtr/input/800bc51ac5086482af9e6cd0b76afefee55e6e91521571e33e8d5f0501f5d632_4293
--
Path = /tmp/extractor/tmpu_d9bvtr/input/800bc51ac5086482af9e6cd0b76afefee55e6e91521571e33e8d5f0501f5d632_4293
Type = ELF
Physical Size = 4293
CPU = MIPS
Big-endian = +
Host OS = None
Characteristics = Executable file
Headers Size = 308

Everything is Ok

Files: 7
Size:       4577
Compressed: 4293

entropy 	

0.64

password 	

IeY8omJwGlGkIbJm2FH MV4fLsXE8ieu0gNYwE6Ty

size packed 	

4,037

size unpacked 	

4,577

number of excluded files 	

0

number of unpacked directories 	

0

Frontend logs

fact_main_frontend.log

PASTE HERE

Other information

I notice that all extracted binaries have extracted section numbered with a single number: the example binary gets extracted to files "0","1","2","4". Maybe this can be used for detection.
Or maybe more specialized tools should be used for detection and extraction of SFX instead of 7-zip.

[jstucke]

The problem originates from the SFX unpacking plugin in the extractor. There, the results are already filtered. But there is a special case: If the section header table is stripped from the binary, the files unpacked by 7z are named 0, 1, 2 and so on instead of the section names.

https://github.com/fkie-cad/fact_extractor/pull/135 should fix this (not really an elegant solution but it should work)