extractors: pefile: extract OS and format

capa/features/extractors/pefile.py

@@ -9,12 +9,14 @@ import logging
 
 import pefile
 
+import capa.features.common
 import capa.features.extractors
 import capa.features.extractors.helpers
 import capa.features.extractors.strings
 from capa.features.file import Export, Import, Section
 from capa.features.common import String, Characteristic
 from capa.features.extractors.base_extractor import FeatureExtractor
+from capa.features.common import CHARACTERISTIC_WINDOWS, CHARACTERISTIC_PE
 
 logger = logging.getLogger(__name__)
 
@@ -110,6 +112,16 @@ def extract_file_function_names(pe, file_path):
     return
 
 
+def extract_os(pe, file_path):
+    # assuming PE -> Windows
+    # though i suppose they're also used by UEFI
+    yield CHARACTERISTIC_WINDOWS, 0x0
+
+
+def extract_format(pe, file_path):
+    yield CHARACTERISTIC_PE, 0x0
+
+
 def extract_file_features(pe, file_path):
     """
     extract file features from given workspace
@@ -134,6 +146,8 @@ FILE_HANDLERS = (
     extract_file_section_names,
     extract_file_strings,
     extract_file_function_names,
+    extract_os,
+    extract_format,
 )
 
 

tests/fixtures.py

@@ -22,6 +22,7 @@ import capa.features.insn
 import capa.features.common
 import capa.features.basicblock
 from capa.features.common import ARCH_X32, ARCH_X64
+from capa.features.common import CHARACTERISTIC_WINDOWS, CHARACTERISTIC_PE
 
 CD = os.path.dirname(__file__)
 
@@ -499,6 +500,13 @@ FEATURE_PRESENCE_TESTS = sorted(
         ("mimikatz", "function=0x456BB9", capa.features.common.Characteristic("calls to"), False),
         # file/function-name
         ("pma16-01", "file", capa.features.file.FunctionName("__aulldiv"), True),
+        # os & format
+        ("pma16-01", "file", CHARACTERISTIC_WINDOWS, True),
+        ("pma16-01", "function=0x404356", CHARACTERISTIC_WINDOWS, True),
+        ("pma16-01", "function=0x404356,bb=0x4043B9", CHARACTERISTIC_WINDOWS, True),
+        ("pma16-01", "file", CHARACTERISTIC_PE, True),
+        ("pma16-01", "function=0x404356", CHARACTERISTIC_PE, True),
+        ("pma16-01", "function=0x404356,bb=0x4043B9", CHARACTERISTIC_PE, True),
     ],
     # order tests by (file, item)
     # so that our LRU cache is most effective.