diff --git a/capa/ida/plugin/__init__.py b/capa/ida/plugin/__init__.py index ca52e561..f262f486 100644 --- a/capa/ida/plugin/__init__.py +++ b/capa/ida/plugin/__init__.py @@ -21,7 +21,7 @@ logger = logging.getLogger(__name__) class CapaExplorerPlugin(idaapi.plugin_t): # Mandatory definitions - PLUGIN_NAME = "FLARE capa plugin" + PLUGIN_NAME = "FLARE capa explorer" PLUGIN_VERSION = "1.0.0" PLUGIN_AUTHORS = "michael.hunhoff@mandiant.com, william.ballenthin@mandiant.com, moritz.raabe@mandiant.com" diff --git a/capa/ida/plugin/capa_plugin_ida.py b/capa/ida/plugin/capa_explorer.py similarity index 100% rename from capa/ida/plugin/capa_plugin_ida.py rename to capa/ida/plugin/capa_explorer.py diff --git a/capa/ida/plugin/item.py b/capa/ida/plugin/item.py index b63886fc..6cf24267 100644 --- a/capa/ida/plugin/item.py +++ b/capa/ida/plugin/item.py @@ -341,12 +341,12 @@ class CapaExplorerByteViewItem(CapaExplorerFeatureItem): class CapaExplorerStringViewItem(CapaExplorerFeatureItem): """store data for string match""" - def __init__(self, parent, display, location): + def __init__(self, parent, display, location, value): """initialize item @param parent: parent node @param display: text to display in UI @param location: virtual address as seen by IDA """ - super(CapaExplorerStringViewItem, self).__init__(parent, display, location=location) + super(CapaExplorerStringViewItem, self).__init__(parent, display, location=location, details=value) self.ida_highlight = idc.get_color(location, idc.CIC_ITEM) diff --git a/capa/ida/plugin/model.py b/capa/ida/plugin/model.py index 4626a01d..e95e6b9a 100644 --- a/capa/ida/plugin/model.py +++ b/capa/ida/plugin/model.py @@ -522,7 +522,7 @@ class CapaExplorerDataModel(QtCore.QAbstractItemModel): ) if feature["type"] == "regex": - return CapaExplorerFeatureItem(parent, display, location, details=feature["match"]) + return CapaExplorerStringViewItem(parent, display, location, feature["match"]) if feature["type"] == "basicblock": return CapaExplorerBlockItem(parent, location) @@ -547,7 +547,7 @@ class CapaExplorerDataModel(QtCore.QAbstractItemModel): if feature["type"] in ("string",): # display string preview - return CapaExplorerStringViewItem(parent, display, location) + return CapaExplorerStringViewItem(parent, display, location, feature[feature["type"]]) if feature["type"] in ("import", "export"): # display no preview