gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2025-12-23 07:28:34 -08:00
Code Issues Packages Projects Releases Wiki Activity

main: dont save .viv by default, unless CAPA_SAVE_WORKSPACE set

Browse Source 
closes #507
This commit is contained in:
William Ballenthin
2021-06-15 12:24:01 -06:00
parent 9484fadd0f
commit 7f03db9fe4
6 changed files with 20 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
capa/features/freeze.py
View File

@@ -254,7 +254,7 @@ def main(argv=None):
args = parser.parse_args(args=argv) args = parser.parse_args(args=argv)
capa.main.handle_common_args(args) capa.main.handle_common_args(args)
extractor = capa.main.get_extractor(args.sample, args.format, args.backend, sigpaths=args.signatures) extractor = capa.main.get_extractor(args.sample, args.format, args.backend, args.signatures, False)
with open(args.output, "wb") as f: with open(args.output, "wb") as f:
f.write(dump(extractor)) f.write(dump(extractor))

10
capa/main.py
View File

@@ -401,7 +401,7 @@ class UnsupportedRuntimeError(RuntimeError):
pass pass
def get_extractor(path, format, backend, sigpaths, disable_progress=False): def get_extractor(path, format, backend, sigpaths, should_save_workspace, disable_progress=False):
""" """
raises: raises:
UnsupportedFormatError: UnsupportedFormatError:
@@ -430,11 +430,15 @@ def get_extractor(path, format, backend, sigpaths, disable_progress=False):
format = "sc64" format = "sc64"
vw = get_workspace(path, format, sigpaths) vw = get_workspace(path, format, sigpaths)
if should_save_workspace:
logger.debug("saving workspace")
try: try:
vw.saveWorkspace() vw.saveWorkspace()
except IOError: except IOError:
# see #168 for discussion around how to handle non-writable directories # see #168 for discussion around how to handle non-writable directories
logger.info("source directory is not writable, won't save intermediate workspace") logger.info("source directory is not writable, won't save intermediate workspace")
else:
logger.debug("CAPA_SAVE_WORKSPACE unset, not saving workspace")
return capa.features.extractors.viv.extractor.VivisectFeatureExtractor(vw, path) return capa.features.extractors.viv.extractor.VivisectFeatureExtractor(vw, path)
@@ -813,8 +817,10 @@ def main(argv=None):
extractor = capa.features.freeze.load(f.read()) extractor = capa.features.freeze.load(f.read())
else: else:
format = args.format format = args.format
should_save_workspace = os.environ.get("CAPA_SAVE_WORKSPACE") not in ("0", "no", "NO", "n", None)
try: try:
extractor = get_extractor(args.sample, format, args.backend, args.signatures, disable_progress=args.quiet) extractor = get_extractor(args.sample, format, args.backend, args.signatures, should_save_workspace, disable_progress=args.quiet)
except UnsupportedFormatError: except UnsupportedFormatError:
logger.error("-" * 80) logger.error("-" * 80)
logger.error(" Input file does not appear to be a PE file.") logger.error(" Input file does not appear to be a PE file.")

3
scripts/bulk-process.py
View File

@@ -95,9 +95,10 @@ def get_capa_results(args):
capabilities (dict): the matched capabilities and their result objects capabilities (dict): the matched capabilities and their result objects
""" """
rules, format, path = args rules, format, path = args
should_save_workspace = os.environ.get("CAPA_SAVE_WORKSPACE") not in ("0", "no", "NO", "n", None)
logger.info("computing capa results for: %s", path) logger.info("computing capa results for: %s", path)
try: try:
extractor = capa.main.get_extractor(path, format, capa.main.BACKEND_VIV, args.signatures, disable_progress=True) extractor = capa.main.get_extractor(path, format, capa.main.BACKEND_VIV, args.signatures, should_save_workspace, disable_progress=True)
except capa.main.UnsupportedFormatError: except capa.main.UnsupportedFormatError:
# i'm 100% sure if multiprocessing will reliably raise exceptions across process boundaries. # i'm 100% sure if multiprocessing will reliably raise exceptions across process boundaries.
# so instead, return an object with explicit success/failure status. # so instead, return an object with explicit success/failure status.

2
scripts/capa_as_library.py
View File

@@ -193,7 +193,7 @@ def render_dictionary(doc):
def capa_details(file_path, output_format="dictionary"): def capa_details(file_path, output_format="dictionary"):
# extract features and find capabilities # extract features and find capabilities
extractor = capa.main.get_extractor(file_path, "auto", capa.main.BACKEND_VIV, sigpaths=[], disable_progress=True) extractor = capa.main.get_extractor(file_path, "auto", capa.main.BACKEND_VIV, [], False, disable_progress=True)
capabilities, counts = capa.main.find_capabilities(rules, extractor, disable_progress=True) capabilities, counts = capa.main.find_capabilities(rules, extractor, disable_progress=True)
# collect metadata (used only to make rendering more complete) # collect metadata (used only to make rendering more complete)

2
scripts/lint.py
View File

@@ -220,7 +220,7 @@ class DoesntMatchExample(Lint):
try: try:
extractor = capa.main.get_extractor( extractor = capa.main.get_extractor(
path, "auto", capa.main.BACKEND_VIV, sigpaths=DEFAULT_SIGNATURES, disable_progress=True path, "auto", capa.main.BACKEND_VIV, DEFAULT_SIGNATURES, False, disable_progress=True
) )
capabilities, meta = capa.main.find_capabilities(ctx["rules"], extractor, disable_progress=True) capabilities, meta = capa.main.find_capabilities(ctx["rules"], extractor, disable_progress=True)
except Exception as e: except Exception as e:

3
scripts/show-capabilities-by-function.py
View File

@@ -152,9 +152,10 @@ def main(argv=None):
extractor = capa.features.freeze.load(f.read()) extractor = capa.features.freeze.load(f.read())
else: else:
format = args.format format = args.format
should_save_workspace = os.environ.get("CAPA_SAVE_WORKSPACE") not in ("0", "no", "NO", "n", None)
try: try:
extractor = capa.main.get_extractor(args.sample, args.format, args.backend, args.signatures) extractor = capa.main.get_extractor(args.sample, args.format, args.backend, args.signatures, should_save_workspace)
except capa.main.UnsupportedFormatError: except capa.main.UnsupportedFormatError:
logger.error("-" * 80) logger.error("-" * 80)
logger.error(" Input file does not appear to be a PE file.") logger.error(" Input file does not appear to be a PE file.")