gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2026-02-04 11:07:53 -08:00
Code Issues Packages Projects Releases Wiki Activity

make more fields optional for more flexible model

Browse Source 
tmp
This commit is contained in:
mr-tz
2024-12-12 09:43:45 +00:00
parent 893378c10e
commit 55720ddbfd
3 changed files with 10 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
capa/features/extractors/vmray/__init__.py
View File

@@ -36,8 +36,8 @@ class VMRayMonitorProcess:
monitor_id: int # unique ID assigned to process by VMRay
origin_monitor_id: int # unique VMRay ID of parent process
image_name: str
filename: str
cmd_line: str
filename: Optional[str] = ""
cmd_line: Optional[str] = ""
class VMRayAnalysis:
@@ -151,8 +151,9 @@ class VMRayAnalysis:
for pefile_section in self.sample_file_static_data.pe.sections:
self.sections[pefile_section.virtual_address] = pefile_section.name
elif self.sample_file_static_data.elf:
for elffile_section in self.sample_file_static_data.elf.sections:
self.sections[elffile_section.header.sh_addr] = elffile_section.header.sh_name
if self.sample_file_static_data.elf.sections:
for elffile_section in self.sample_file_static_data.elf.sections:
self.sections[elffile_section.header.sh_addr] = elffile_section.header.sh_name
def _compute_monitor_processes(self):
for process in self.sv2.processes.values():

6
capa/features/extractors/vmray/models.py
View File

@@ -276,7 +276,7 @@ class ElfFileHeader(BaseModel):
class ElfFile(BaseModel):
# file_header: ElfFileHeader
sections: list[ElfFileSection]
sections: Optional[list[ElfFileSection]] = None
class StaticData(BaseModel):
@@ -316,9 +316,9 @@ class Process(BaseModel):
# monitor_reason: str
origin_monitor_id: int # VMRay ID of parent process
os_pid: int
filename: SanitizedString
filename: Optional[SanitizedString] = ""
image_name: str
cmd_line: SanitizedString
cmd_line: Optional[SanitizedString] = ""
ref_parent_process: Optional[GenericReference] = None

4
tests/test_vmray_model.py
View File

@@ -103,8 +103,8 @@ def test_vmray_model_elffile():
"""
)
assert elffile.sections[0].header.sh_name == "abcd1234"
assert elffile.sections[0].header.sh_addr == 2863311530
assert elffile.sections and elffile.sections[0].header.sh_name == "abcd1234"
assert elffile.sections and elffile.sections[0].header.sh_addr == 2863311530
def test_vmray_model_pefile():