fix: demo extractor updated yara

demo_extractors/complex/complex.py

@@ -1,9 +1,9 @@
 from io import BytesIO
-from typing import Dict, List, Optional
+from typing import List, Optional
 
 from maco import extractor, model, yara
 
-from . import complex_utils
+from complex import complex_utils
 
 
 class Complex(extractor.Extractor):
@@ -50,7 +50,7 @@ def run(self, stream: BytesIO, matches: List[yara.Match]) -> Optional[model.Extr
         other = complex_utils.getdata()["result"]
         self.logger.debug("got data from lib")
         # example - accessing yara strings
-        strings = {y[2].decode("utf8") for x in matches for y in x.strings}
+        strings = sorted({z.plaintext().decode("utf8") for x in matches for y in x.strings for z in y.instances})
         self.logger.debug(f"{strings=}")
         # construct model of results
         tmp = model.ExtractorModel(family=self.family)

tests/data/trigger_complex.txt

@@ -0,0 +1,6 @@
+file to trigger demo extractors
+
+self_trigger
+
+Complex
+Paradise

tests/test_demo_extractors.py

@@ -0,0 +1,60 @@
+import os
+import unittest
+
+from maco import cli
+from maco.collector import Collector
+
+
+class TestDemoExtractors(unittest.TestCase):
+    def test_complex(self):
+        path_file = os.path.normpath(
+            os.path.join(__file__, "../data/trigger_complex.txt")
+        )
+        collector = Collector(os.path.join(__file__, "../../demo_extractors"))
+        self.assertEqual(
+            set(collector.extractors.keys()),
+            {
+                "Elfy",
+                "Nothing",
+                "Complex",
+                "LimitOther",
+            },
+        )
+
+        with open(path_file, "rb") as stream:
+            ret = cli.process_file(
+                collector,
+                path_file,
+                stream,
+                pretty=True,
+                force=False,
+                include_base64=False,
+            )
+        self.assertEqual(
+            ret,
+            {
+                "Complex": {
+                    "family": "complex",
+                    "version": "5",
+                    "decoded_strings": sorted(["Paradise", "Complex"]),
+                    "binaries": [
+                        {
+                            "datatype": "payload",
+                            "encryption": {"algorithm": "something"},
+                            "sha256": "1307990e6ba5ca145eb35e99182a9bec46531bc54ddf656a602c780fa0240dee",
+                            "size": 9,
+                            "hex_sample": "736F6D652064617461",
+                        }
+                    ],
+                    "http": [
+                        {
+                            "protocol": "https",
+                            "hostname": "blarg5.com",
+                            "path": "/malz/64",
+                            "usage": "c2",
+                        }
+                    ],
+                    "encryption": [{"algorithm": "sha256"}],
+                }
+            },
+        )