Skip to content

Commit 95fa5df

Browse files
add feature snapshot manifest.json
The manifest was accidentally omitted from 6d39e53 (the commit that added the .frz fixtures). Without it, test_feature_snapshots.py crashes during collection with FileNotFoundError. Also un-ignore this specific .json file in .gitignore (*.json is blanket-ignored in this repo). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 8997a35 commit 95fa5df

2 files changed

Lines changed: 50 additions & 0 deletions

File tree

.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
*.idb
33
*.i64
44
*.json
5+
!fixtures/snapshots/features/manifest.json
56
*.txt
67
# IDA Pro intermediate database files
78
*.nam
Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"version": 1,
3+
"description": "Feature snapshot fixtures. See README.md.",
4+
"snapshots": [
5+
{
6+
"name": "pma01-01-dll",
7+
"sample": "Practical Malware Analysis Lab 01-01.dll_",
8+
"freeze": "pma01-01-dll.frz",
9+
"explanation": "Smallest PE 32-bit DLL in the corpus. Fast baseline for the PE DLL path through the viv backend (exports, imports, small function count).",
10+
"generated_at_commit": "cd07bd230e831cb216450aec98859ae1dc6b16ff"
11+
},
12+
{
13+
"name": "mimikatz-exe",
14+
"sample": "mimikatz.exe_",
15+
"freeze": "mimikatz-exe.frz",
16+
"explanation": "Well-known PE 32-bit EXE with a wide variety of features. Exercises the PE EXE path through viv against a realistic, feature-dense sample.",
17+
"generated_at_commit": "cd07bd230e831cb216450aec98859ae1dc6b16ff"
18+
},
19+
{
20+
"name": "pma21-01-exe",
21+
"sample": "Practical Malware Analysis Lab 21-01.exe_",
22+
"freeze": "pma21-01-exe.frz",
23+
"explanation": "PE 64-bit EXE. Covers amd64 disassembly distinct from the 32-bit PE fixtures above.",
24+
"generated_at_commit": "cd07bd230e831cb216450aec98859ae1dc6b16ff"
25+
},
26+
{
27+
"name": "7351f-elf",
28+
"sample": "7351f8a40c5450557b24622417fc478d.elf_",
29+
"freeze": "7351f-elf.frz",
30+
"explanation": "ELF binary via the viv backend. Exercises the ELF loader plus OS/arch detection for non-PE samples.",
31+
"generated_at_commit": "cd07bd230e831cb216450aec98859ae1dc6b16ff"
32+
},
33+
{
34+
"name": "1c444-dotnet",
35+
"sample": "dotnet/1c444ebeba24dcba8628b7dfe5fec7c6.exe_",
36+
"freeze": "1c444-dotnet.frz",
37+
"explanation": "Small .NET assembly. Exercises the dotnet backend (dnfile/dotnetfile), which is a completely separate extraction pipeline from viv.",
38+
"generated_at_commit": "cd07bd230e831cb216450aec98859ae1dc6b16ff"
39+
},
40+
{
41+
"name": "mimikatz-exe-ida",
42+
"sample": "mimikatz.exe_",
43+
"freeze": "mimikatz-exe-ida.frz",
44+
"backend": "ida",
45+
"explanation": "Mimikatz via idalib. Exercises the IDA backend against the same sample as mimikatz-exe (viv), enabling cross-backend comparison.",
46+
"generated_at_commit": "dfb34f06a0826c2445a1618530d0f83566b72f7f"
47+
}
48+
]
49+
}

0 commit comments

Comments
 (0)