diff --git a/CHANGELOG.md b/CHANGELOG.md index 05c13869..247aced1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -50,6 +50,7 @@ - fix: correct wrong dict key in VMRay _compute_monitor_threads assertion (used thread_id instead of process_id) @williballenthin fix: replace assert with isinstance guard in get_callee for invalid MethodSpec tokens @williballenthin - fix: replace assert with isinstance guard in get_callee for invalid MethodSpec tokens @williballenthin +- fix: allocate feat_dict per feature in parse_json to avoid shared-reference aliasing @williballenthin (SURF-72) - fix: add missing capa.features.extractors.elf import to ghidra/helpers.py and ida/helpers.py @williballenthin (SURF-71) - fix: remove dead view_tab_rulegen assignment from CapaExplorerForm that was never read @williballenthin (SURF-70) - fix: remove dead reset_query method from CapaExplorerSearchProxyModel that was never called @williballenthin (SURF-69) diff --git a/capa/ghidra/plugin/capa_explorer.py b/capa/ghidra/plugin/capa_explorer.py index 974a8150..1eb9ebf3 100644 --- a/capa/ghidra/plugin/capa_explorer.py +++ b/capa/ghidra/plugin/capa_explorer.py @@ -267,7 +267,7 @@ def get_capabilities(): rules_dir = "" show_monitor_message(f"requesting capa {capa.version.__version__} rules directory") - selected_dir = askDirectory(f"choose capa {capa.version.__version__} rules directory", "Ok") # type: ignore [name-defined] # noqa: F821 + selected_dir = askDirectory(f"choose capa {capa.version.__version__} rules directory", "Ok") # type: ignore[name-defined] # noqa: F821 # Ghidra scripting environment provides this builtin if selected_dir: rules_dir = selected_dir.getPath() @@ -346,10 +346,8 @@ def parse_json(capa_data): # feature[0]: location # feature[1]: node features = capability.get("matches")[i][1] - feat_dict = {} for feature in get_locations(features): - feat_dict[feature[0]] = feature[1] - rule_matches[match_loc].append(feat_dict) + rule_matches[match_loc].append({feature[0]: feature[1]}) # dict data of currently matched rule meta = capability["meta"] @@ -401,7 +399,7 @@ def main(): for c in choice_labels: choice_labels_java.add(c) - selected = list(askChoices("capa explorer", "select actions:", choices_java, choice_labels_java)) # type: ignore [name-defined] # noqa: F821 + selected = list(askChoices("capa explorer", "select actions:", choices_java, choice_labels_java)) # type: ignore[name-defined] # noqa: F821 # Ghidra scripting environment provides this builtin do_namespaces = "namespaces" in selected do_comments = "comments" in selected