Skip to content

ADR 0001: Static-only analysis, and no live malware anywhere in the pipeline

  • Status: accepted
  • Date: 2026-09-26

Context

VITRINE is a triage front-end. The spec asks for an explainable verdict and a candidate YARA rule "without ever executing the sample". The ML model also needs real malware to learn from, and holding live binaries on a developer laptop or in CI is a liability.

Decision

  1. The dissector only reads bytes. It never calls LoadLibrary, maps the image, or emulates code. Every read is bounds-checked and malformed input raises PEParseError, which the fuzz test checks with random header bit-flips.
  2. Training and benchmarking use EMBER 2018 pre-extracted features (JSON, no binaries). Real-benign testing uses PE files already installed on a Windows machine, read in place. They are never copied into the repository.
  3. The committed fixtures are (a) synthetic, inert PEs built in code and (b) 40 EMBER feature records. Neither can execute.

Consequences

  • Everything can run on a normal laptop and in GitHub Actions with no special handling.
  • Byte-level YARA rules (string atoms) can only be shown on the synthetic families. On real malware we can only synthesize structural rules, because EMBER has imports, section names and imphash but no raw strings. See ADR 0004.
  • Our extractor has to reproduce EMBER's raw-feature schema from bytes without LIEF (ADR 0002).