mirror of
https://github.com/mandiant/capa.git
synced 2025-12-22 07:10:29 -08:00
Update detect_duplicate_features.py
Added a main routine and using argparse to retrieve these from the command line
This commit is contained in:
@@ -1,4 +1,5 @@
|
|||||||
import os
|
import os
|
||||||
|
import argparse
|
||||||
|
|
||||||
import yaml
|
import yaml
|
||||||
|
|
||||||
@@ -54,20 +55,35 @@ def find_overlapping_rules(new_rule_path, rules_path):
|
|||||||
return result
|
return result
|
||||||
|
|
||||||
|
|
||||||
# usage
|
# python script.py --base-dir /path/to/capa/rules rules/anti-analysis/reference-analysis-tools-strings.yml rules
|
||||||
base_dir = ""
|
|
||||||
new_rule_path = base_dir + "rules\\anti-analysis\\reference-analysis-tools-strings.yml"
|
|
||||||
rules_path = base_dir + "rules"
|
|
||||||
|
|
||||||
try:
|
|
||||||
|
def main():
|
||||||
|
# usage
|
||||||
|
|
||||||
|
parser = argparse.ArgumentParser(description="Find overlapping rules in Capa rules.")
|
||||||
|
parser.add_argument("-b", "--base-dir", default="", help="Base directory for Capa rules.")
|
||||||
|
parser.add_argument("-f", "--new_rule_path", required=True, help="Path to the new Capa rule.")
|
||||||
|
parser.add_argument("-d", "--rules_path", required=True, help="Path to the directory containing Capa rules.")
|
||||||
|
args = parser.parse_args()
|
||||||
|
|
||||||
|
base_dir = args.base_dir
|
||||||
|
new_rule_path = os.path.join(base_dir, args.new_rule_path)
|
||||||
|
rules_path = os.path.join(base_dir, args.rules_path)
|
||||||
|
|
||||||
|
try:
|
||||||
result = find_overlapping_rules(new_rule_path, rules_path)
|
result = find_overlapping_rules(new_rule_path, rules_path)
|
||||||
print("New rule path : %s" % new_rule_path)
|
print("New rule path : %s" % new_rule_path)
|
||||||
print("Number of rules checked : %s " % result["count"])
|
print("Number of rules checked : %s " % result["count"])
|
||||||
print("Paths to overlapping rules : ", result["overlapping_rules"])
|
print("Paths to overlapping rules : ", result["overlapping_rules"])
|
||||||
print("Number of rules containing same features : %s" % len(result["overlapping_rules"]))
|
print("Number of rules containing same features : %s" % len(result["overlapping_rules"]))
|
||||||
except Exception as e:
|
except Exception as e:
|
||||||
print(e)
|
print(e)
|
||||||
try:
|
try:
|
||||||
print(result, "")
|
print(result, "")
|
||||||
except:
|
except:
|
||||||
pass
|
pass
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
main()
|
||||||
|
|||||||
Reference in New Issue
Block a user