Support VMRay Function Log (flog) JSON version

[r0ny123]

Currently, capa identifies program capabilities from dynamic analysis generated via the VMRay sandbox. As per the current implementation, capa requires a ZIP file (analysis archive) containing the sample and a function log file in XML format. However, this particular archive is not available for free users to download. Given that the function log in JSON format is freely available (e.g. Function log JSON file) — and is also more readable and understandable compared to the XML file—could we add support for capa to analyze the dynamic behaviours from the JSON file instead?

[mike-hunhoff]

Hi @r0ny123 , thanks for reaching out. I'm not sure if you intended, but the link that you provided is for an unstructured text file (flog.txt)?

[r0ny123]

Apologies for the confusion. It seems I made a mistake while working with logs from different sandboxes which are in JSON. You're right, it's not a JSON file. However, is there a way to parse them without much heavy lifting?

[mr-tz]

It's definitely feasible but we opted for the XML because it's a little easier and cleaner to parse. If you or anyone else want to contribute a flog.txt parser let's discuss in a separate issue on how we can support that.
Currently, we also expect a second file with meta data (summary_v2.json) and the sample bytes to be available so we can extract a complete set of features. This could be adjusted if needed.

[r0ny123]

Let's open an issue then if someone wants to contribute.