csababarta / memory-baseliner Goto Github PK

When no additional options are chosen, each file output has a first line of PROCESSES | SERVICES | DRIVERS, but these are not present when other options are chosen (which is the likely desired state). I would vote to remove them altogether as they make it more difficult to filter data in tools like Excel/Timeline Explorer. I recommend having the first line be the column names for all output types for easy import into other tools.

Tool does not gracefully exit if you provide the wrong jsonbaseline file (in the errors below a "proc" baseline was fed to -drv and -svc options, but it occurs with all of the options)

root@siftworkstation:/opt/memory-baseliner2# python3 ./baseline.py -drv -b /cases/memory/baseline/Win10x64.img -i /cases/memory/memory.img --loadbaseline --jsonbaseline ./baseline_proc.json
Traceback (most recent call last):
File "./baseline.py", line 455, in
baseline_drivers.from_json(args.jsonbaseline)
File "/opt/memory-baseliner2/baseline_objects.py", line 1458, in from_json
driver.from_dict(entry)
File "/opt/memory-baseliner2/baseline_objects.py", line 1253, in from_dict
self.driver_name = entry['driver_name']
KeyError: 'driver_name'

root@siftworkstation:/opt/memory-baseliner2# python3 ./baseline.py -svc -b /cases/memory/baseline/Win10x64.img -i /cases/memory/memory.img --loadbaseline --jsonbaseline ./baseline_proc.json
2022-05-19 11:55:12,958 - BaselineService - ERROR - Could not create service object from JSON! ('service_name')
Traceback (most recent call last):
File "/opt/memory-baseliner2/baseline_objects.py", line 1930, in from_json
service.from_dict(svc)
File "/opt/memory-baseliner2/baseline_objects.py", line 1710, in from_dict
self.service_name = service_dict['service_name']
KeyError: 'service_name'