gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2025-12-22 23:26:21 -08:00
Code Issues Packages Projects Releases Wiki Activity

adding new item type for subscope to help render

Browse Source
This commit is contained in:
Michael Hunhoff
2020-07-01 13:38:20 -06:00
parent 2a43557f5f
commit 1cf36b5792
2 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
capa/ida/explorer/item.py
View File

@@ -184,6 +184,14 @@ class CapaExplorerFunctionItem(CapaExplorerDataItem):
self._data[0] = self.fmt % display
class CapaExplorerSubscopeItem(CapaExplorerDataItem):
fmt = 'subscope(%s)'
def __init__(self, parent, scope):
super(CapaExplorerSubscopeItem, self).__init__(parent, [self.fmt % scope, '', ''])
class CapaExplorerBlockItem(CapaExplorerDataItem):
""" store data relevant to capa basic block result """

7
capa/ida/explorer/model.py
View File

@@ -16,7 +16,8 @@ from capa.ida.explorer.item import (
CapaExplorerByteViewItem,
CapaExplorerBlockItem,
CapaExplorerRuleMatchItem,
CapaExplorerFeatureItem
CapaExplorerFeatureItem,
CapaExplorerSubscopeItem
)
import capa.ida.helpers
@@ -105,7 +106,7 @@ class CapaExplorerDataModel(QtCore.QAbstractItemModel):
if role == QtCore.Qt.FontRole and isinstance(item, (CapaExplorerRuleItem, CapaExplorerRuleMatchItem,
CapaExplorerBlockItem, CapaExplorerFunctionItem,
CapaExplorerFeatureItem)) and \
CapaExplorerFeatureItem, CapaExplorerSubscopeItem)) and \
column == CapaExplorerDataModel.COLUMN_INDEX_RULE_INFORMATION:
# set bold font for top-level rules
font = QtGui.QFont()
@@ -334,7 +335,7 @@ class CapaExplorerDataModel(QtCore.QAbstractItemModel):
return CapaExplorerFeatureItem(parent, display=display)
elif statement['type'] == 'subscope':
return CapaExplorerFeatureItem(parent, 'subscope(%s)' % statement['subscope'])
return CapaExplorerSubscopeItem(parent, statement['subscope'])
elif statement['type'] == 'regex':
# regex is a `Statement` not a `Feature`
# this is because it doesn't get extracted, but applies to all strings in scope.