Protocol Analysis/Decoder Framework
Clone or download
Mraoul Change how strings are handled in the 'prnt' family of functions to d…
…efault to unicode, this should allow the code to closer mimic how python's standard 'print' function works on input
Latest commit ca5d5cf Oct 24, 2018

ChopShop 4

Protocol Analysis/Decoder Framework


ChopShop is a MITRE developed framework to aid analysts in the creation and execution of pynids based decoders and detectors of APT tradecraft.

Note that ChopShop is still in perpetual beta and is dependent on libnids/pynids for the majority of its underlying functionality.

Documentation for ChopShop can be found on ReadTheDocs.

Note: There is a known issue when running ChopShop on Ubuntu where the version of pynids obtained via apt causes an ImportError. Per, this issue affects some variants of at least 11.10 and 12.04. A workaround is to compile pynids from source which can be obtained from