gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2025-12-24 03:57:34 -08:00
Code Issues Packages Projects Releases Wiki Activity

extractors: viv: extract format and OS at all scopes

Browse Source
This commit is contained in:
William Ballenthin
2021-08-11 14:44:41 -06:00
parent fa8b4a4203
commit 294f74b209
3 changed files with 59 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
scripts/show-features.py
View File

@@ -76,6 +76,7 @@ import capa.engine
import capa.helpers
import capa.features
import capa.features.freeze
import capa.features.common
logger = logging.getLogger("capa.show-features")
@@ -193,6 +194,15 @@ def ida_main():
return 0
def is_global_feature(feature):
if (isinstance(feature, capa.features.common.Characteristic)
and isinstance(feature.value, str)
and (feature.value.startswith("os/")
or feature.value.startswith("format/"))):
return True
return False
def print_features(functions, extractor):
for f in functions:
function_address = int(f)
@@ -203,14 +213,23 @@ def print_features(functions, extractor):
continue
for feature, va in extractor.extract_function_features(f):
if is_global_feature(feature):
continue
print("func: 0x%08x: %s" % (va, feature))
for bb in extractor.get_basic_blocks(f):
for feature, va in extractor.extract_basic_block_features(f, bb):
if is_global_feature(feature):
continue
print("bb : 0x%08x: %s" % (va, feature))
for insn in extractor.get_instructions(f, bb):
for feature, va in extractor.extract_insn_features(f, bb, insn):
if is_global_feature(feature):
continue
try:
print("insn: 0x%08x: %s" % (va, feature))
except UnicodeEncodeError: