mirror of
https://github.com/mandiant/capa.git
synced 2026-02-04 19:12:01 -08:00
Fix lint issues
This commit is contained in:
@@ -10,16 +10,30 @@ import capa.features
|
||||
import capa.features.extractors.elf
|
||||
import capa.features.extractors.pefile
|
||||
import capa.features.extractors.strings
|
||||
from capa.features.common import OS, FORMAT_PE, FORMAT_ELF, OS_ANY, OS_WINDOWS, FORMAT_FREEZE, FORMAT_RESULT, ARCH_ANY, Arch, Format, String, Feature
|
||||
from capa.features.common import (
|
||||
OS,
|
||||
OS_ANY,
|
||||
ARCH_ANY,
|
||||
FORMAT_PE,
|
||||
FORMAT_ELF,
|
||||
OS_WINDOWS,
|
||||
FORMAT_FREEZE,
|
||||
FORMAT_RESULT,
|
||||
Arch,
|
||||
Format,
|
||||
String,
|
||||
Feature,
|
||||
)
|
||||
from capa.features.freeze import is_freeze
|
||||
from capa.features.address import NO_ADDRESS, Address, FileOffsetAddress
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
#match strings for formats
|
||||
# match strings for formats
|
||||
MATCH_PE = b"MZ"
|
||||
MATCH_ELF = b"\x7fELF"
|
||||
MATCH_RESULT = b"{\"meta\":"
|
||||
MATCH_RESULT = b'{"meta":'
|
||||
|
||||
|
||||
def extract_file_strings(buf, **kwargs) -> Iterator[Tuple[String, Address]]:
|
||||
"""
|
||||
@@ -57,7 +71,7 @@ def extract_arch(buf) -> Iterator[Tuple[Feature, Address]]:
|
||||
elif buf.startswith(MATCH_ELF):
|
||||
with contextlib.closing(io.BytesIO(buf)) as f:
|
||||
arch = capa.features.extractors.elf.detect_elf_arch(f)
|
||||
|
||||
|
||||
elif buf.startswith(MATCH_RESULT):
|
||||
arch = ARCH_ANY
|
||||
|
||||
|
||||
@@ -65,7 +65,7 @@ from capa.features.common import (
|
||||
FORMAT_SC64,
|
||||
FORMAT_DOTNET,
|
||||
FORMAT_FREEZE,
|
||||
FORMAT_RESULT
|
||||
FORMAT_RESULT,
|
||||
)
|
||||
from capa.features.address import NO_ADDRESS, Address
|
||||
from capa.features.extractors.base_extractor import BBHandle, InsnHandle, FunctionHandle, FeatureExtractor
|
||||
|
||||
@@ -5,8 +5,8 @@
|
||||
# Unless required by applicable law or agreed to in writing, software distributed under the License
|
||||
# is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and limitations under the License.
|
||||
import datetime
|
||||
import json
|
||||
import datetime
|
||||
from typing import Any, Dict, List, Tuple, Union, Optional
|
||||
|
||||
from pydantic import Field, BaseModel
|
||||
@@ -152,18 +152,14 @@ class Metadata(FrozenModel):
|
||||
},
|
||||
"feature_counts": {
|
||||
"file": self.analysis.feature_counts.file,
|
||||
"functions": {
|
||||
fc.address.to_capa(): fc.count for fc in self.analysis.feature_counts.functions
|
||||
},
|
||||
},
|
||||
"library_functions": {
|
||||
lf.address.to_capa(): lf.name for lf in self.analysis.library_functions
|
||||
"functions": {fc.address.to_capa(): fc.count for fc in self.analysis.feature_counts.functions},
|
||||
},
|
||||
"library_functions": {lf.address.to_capa(): lf.name for lf in self.analysis.library_functions},
|
||||
},
|
||||
}
|
||||
|
||||
return capa_meta
|
||||
|
||||
|
||||
|
||||
class CompoundStatementType:
|
||||
AND = "and"
|
||||
@@ -580,7 +576,7 @@ class ResultDocument(BaseModel):
|
||||
)
|
||||
|
||||
return ResultDocument(meta=Metadata.from_capa(meta), rules=rule_matches)
|
||||
|
||||
|
||||
def to_capa(self) -> Tuple[Dict, Dict]:
|
||||
meta = self.meta.to_capa()
|
||||
capabilities: Dict[str, List[Tuple[frz.Address, capa.features.common.Result]]] = {}
|
||||
@@ -607,10 +603,11 @@ class ResultDocument(BaseModel):
|
||||
statement=statement,
|
||||
success=match.success,
|
||||
locations=[frz.Address.to_capa(loc) for loc in match.locations],
|
||||
children=[])
|
||||
children=[],
|
||||
)
|
||||
|
||||
if rule_name not in capabilities:
|
||||
capabilities[rule_name] = []
|
||||
capabilities[rule_name].append((frz.Address.from_capa(addr), result))
|
||||
|
||||
return meta, capabilities
|
||||
return meta, capabilities
|
||||
|
||||
@@ -230,11 +230,13 @@ def test_basic_block_node_from_capa():
|
||||
assert isinstance(node, rdoc.FeatureNode)
|
||||
assert isinstance(node.feature, frzf.BasicBlockFeature)
|
||||
|
||||
|
||||
def test_json_to_rdoc():
|
||||
path = fixtures.get_data_path_by_name("pma01-01-rd")
|
||||
assert isinstance(rdoc.ResultDocument.parse_file(path),rdoc.ResultDocument)
|
||||
assert isinstance(rdoc.ResultDocument.parse_file(path), rdoc.ResultDocument)
|
||||
|
||||
|
||||
def test_rdoc_to_capa():
|
||||
path = fixtures.get_data_path_by_name("pma01-01-rd")
|
||||
assert len(rdoc.ResultDocument.parse_file(path).to_capa()) ==2
|
||||
assert isinstance(rdoc.ResultDocument.parse_file(path).to_capa(),tuple)
|
||||
assert len(rdoc.ResultDocument.parse_file(path).to_capa()) == 2
|
||||
assert isinstance(rdoc.ResultDocument.parse_file(path).to_capa(), tuple)
|
||||
|
||||
Reference in New Issue
Block a user