gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2026-02-04 19:12:01 -08:00
Code Issues Packages Projects Releases Wiki Activity

remove rule param

Browse Source
This commit is contained in:
Pratham Chauhan
2023-03-29 19:50:07 +05:30
parent a13ce094b3
commit 6ed7aca5be
2 changed files with 15 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
capa/main.py
View File

@@ -1126,7 +1126,7 @@ def main(argv=None):
return E_FILE_LIMITATION
if format_ == FORMAT_RESULT:
result_doc = capa.render.result_document.ResultDocument.parse_file(args.sample)
meta, capabilities = result_doc.to_capa(rules)
meta, capabilities = result_doc.to_capa()
elif format_ == FORMAT_FREEZE:
with open(args.sample, "rb") as f:
extractor = capa.features.freeze.load(f.read())

27
capa/render/result_document.py
View File

@@ -581,18 +581,19 @@ class ResultDocument(BaseModel):
return ResultDocument(meta=Metadata.from_capa(meta), rules=rule_matches)
def to_capa(self, rules: RuleSet) -> Tuple[Dict, Dict]:
def to_capa(self) -> Tuple[Dict, Dict]:
meta = self.meta.to_capa()
capabilities: Dict[str, List[Tuple[frz.Address, capa.features.common.Result]]] ={}
capabilities: Dict[str, List[Tuple[frz.Address, capa.features.common.Result]]] = {}
for rule_name, rule_match in self.rules.items():
# Parse the YAML source into a Rule instance
rule = capa.rules.Rule.from_yaml(rule_match.source)
# Extract the capabilities from the RuleMatches object
for addr, match in rule_match.matches:
if isinstance(match.node, StatementNode):
if isinstance(match.node.statement, CompoundStatement):
statement = rules[rule_name].statement
statement = rule.statement
else:
statement = statement_from_capa(match.node.statement)
elif isinstance(match.node, FeatureNode):
@@ -601,15 +602,15 @@ class ResultDocument(BaseModel):
statement.matches = match.captures
else:
raise ValueError("Invalid node type")
result = capa.features.common.Result(
statement=statement,
success=match.success,
locations=[frz.Address.to_capa(loc) for loc in match.locations],
children=[])
statement=statement,
success=match.success,
locations=[frz.Address.to_capa(loc) for loc in match.locations],
children=[])
if rule_name not in capabilities:
capabilities[rule_name]=[]
capabilities[rule_name].append((frz.Address.from_capa(addr),result))
capabilities[rule_name] = []
capabilities[rule_name].append((frz.Address.from_capa(addr), result))
return meta, capabilities