gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2026-02-04 19:12:01 -08:00
Code Issues Packages Projects Releases Wiki Activity

enable os/arch/format for capa explorer

Browse Source
This commit is contained in:
Michael Hunhoff
2021-08-19 13:06:43 -06:00
parent a96a5de12d
commit 3cb7573edb
2 changed files with 13 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
capa/ida/helpers.py
View File

@@ -30,11 +30,12 @@ SUPPORTED_IDA_VERSIONS = [
"7.6",
]
# file type names as returned by idaapi.get_file_type_name()
# file type names as returned by idainfo.file_type
SUPPORTED_FILE_TYPES = [
"Portable executable for 80386 (PE)",
"Portable executable for AMD64 (PE)",
"Binary file", # x86/AMD64 shellcode support
idaapi.f_PE,
idaapi.f_ELF,
# idaapi.f_MACHO,
idaapi.f_BIN,
]
@@ -55,10 +56,10 @@ def is_supported_ida_version():
def is_supported_file_type():
file_type = idaapi.get_file_type_name()
if file_type not in SUPPORTED_FILE_TYPES:
file_info = idaapi.get_inf_structure()
if file_info.filetype not in SUPPORTED_FILE_TYPES:
logger.error("-" * 80)
logger.error(" Input file does not appear to be a PE file.")
logger.error(" Input file does not appear to be a supported file type.")
logger.error(" ")
logger.error(
" capa currently only supports analyzing PE files (or binary files containing x86/AMD64 shellcode) with IDA."

6
capa/ida/plugin/view.py
View File

@@ -1007,7 +1007,11 @@ class CapaExplorerRulegenFeatures(QtWidgets.QTreeWidget):
self.parent_items[feature], (format_feature(feature), format_address(ea)), feature=feature
)
else:
ea = eas.pop()
if eas:
ea = eas.pop()
else:
# some features may not have an address e.g. "format"
ea = ""
for (i, v) in enumerate((format_feature(feature), format_address(ea))):
self.parent_items[feature].setText(i, v)
self.parent_items[feature].setData(0, 0x100, feature)