diff --git a/capa/rules.py b/capa/rules.py index bff1f19e..f81cfac3 100644 --- a/capa/rules.py +++ b/capa/rules.py @@ -58,24 +58,11 @@ SUPPORTED_FEATURES = { capa.features.String, }, FUNCTION_SCOPE: { - capa.features.MatchedRule, - capa.features.insn.API, - capa.features.insn.Number, - capa.features.String, - capa.features.Bytes, - capa.features.insn.Offset, - capa.features.insn.Mnemonic, + # plus basic block scope features, see below capa.features.basicblock.BasicBlock, capa.features.Characteristic("switch"), - capa.features.Characteristic("nzxor"), - capa.features.Characteristic("peb access"), - capa.features.Characteristic("fs access"), - capa.features.Characteristic("gs access"), - capa.features.Characteristic("cross section flow"), - capa.features.Characteristic("stack string"), capa.features.Characteristic("calls from"), capa.features.Characteristic("calls to"), - capa.features.Characteristic("indirect call"), capa.features.Characteristic("loop"), capa.features.Characteristic("recursive call"), }, @@ -98,6 +85,9 @@ SUPPORTED_FEATURES = { }, } +# all basic block scope features are also function scope features +SUPPORTED_FEATURES[FUNCTION_SCOPE].update(SUPPORTED_FEATURES[BASIC_BLOCK_SCOPE]) + class InvalidRule(ValueError): def __init__(self, msg): diff --git a/rules b/rules index 54885300..a8621978 160000 --- a/rules +++ b/rules @@ -1 +1 @@ -Subproject commit 548853005591996b11d6b8d1140c9e353254e9f2 +Subproject commit a8621978cf510a53965b919d7575a1e57d8284ce