diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index ca56d4e3..54e3b490 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -23,6 +23,7 @@ jobs: artifact_name: capa.exe asset_name: windows - os: macos-10.15 + # use older macOS for assumed better portability artifact_name: capa asset_name: macos steps: diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 128c4591..ed866547 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -65,7 +65,7 @@ jobs: strategy: fail-fast: false matrix: - os: [ubuntu-20.04, windows-2019, macos-10.15] + os: [ubuntu-20.04, windows-2019, macos-11] # across all operating systems python-version: ["3.7", "3.10"] include: diff --git a/CHANGELOG.md b/CHANGELOG.md index 8c0c90d4..2255ba2f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -26,7 +26,9 @@ - extractors must use handles to identify functions/basic blocks/instructions #981 @williballenthin - the freeze file format schema was updated, including format version bump to v2 #986 @williballenthin -### New Rules (7) +Deprecation notice: as described in [#937](https://github.com/mandiant/capa/issues/937), we plan to remove the SMDA backend for v5. If you rely on this backend, please reach out so we can discuss extending the support for SMDA or transitioning your workflow to use vivisect. + +### New Rules (9) - data-manipulation/encryption/aes/manually-build-aes-constants huynh.t.nhan@gmail.com - nursery/get-process-image-filename michael.hunhoff@mandiant.com @@ -35,6 +37,8 @@ - anti-analysis/packer/huan/packed-with-huan jakub.jozwiak@mandiant.com - internal/limitation/file/internal-dotnet-file-limitation william.ballenthin@mandiant.com - nursery/get-os-information-via-kuser_shared_data @mr-tz +- load-code/pe/resolve-function-by-parsing-PE-exports sara-rn +- anti-analysis/packer/huan/packed-with-huan jakub.jozwiak@mandiant.com - ### Bug Fixes diff --git a/README.md b/README.md index 184e6198..5edb268b 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ [![PyPI - Python Version](https://img.shields.io/pypi/pyversions/flare-capa)](https://pypi.org/project/flare-capa) [![Last release](https://img.shields.io/github/v/release/mandiant/capa)](https://github.com/mandiant/capa/releases) -[![Number of rules](https://img.shields.io/badge/rules-666-blue.svg)](https://github.com/mandiant/capa-rules) +[![Number of rules](https://img.shields.io/badge/rules-677-blue.svg)](https://github.com/mandiant/capa-rules) [![CI status](https://github.com/mandiant/capa/workflows/CI/badge.svg)](https://github.com/mandiant/capa/actions?query=workflow%3ACI+event%3Apush+branch%3Amaster) [![Downloads](https://img.shields.io/github/downloads/mandiant/capa/total)](https://github.com/mandiant/capa/releases) [![License](https://img.shields.io/badge/license-Apache--2.0-green.svg)](LICENSE.txt) diff --git a/capa/render/verbose.py b/capa/render/verbose.py index a8a99400..48733fe4 100644 --- a/capa/render/verbose.py +++ b/capa/render/verbose.py @@ -44,15 +44,11 @@ def format_address(address: frz.Address) -> str: return f"file+{rutils.hex(address.value)}" elif address.type == frz.AddressType.DN_TOKEN: token = dncil.clr.token.Token(address.value) - name = dnfile.mdtable.ClrMetaDataTableFactory._table_number_map[token.table].name - rid = token.rid - return f"{name}[{rid}]" + return f"token({rutils.hex(token.value)})" elif address.type == frz.AddressType.DN_TOKEN_OFFSET: token, offset = address.value token = dncil.clr.token.Token(token) - name = dnfile.mdtable.ClrMetaDataTableFactory._table_number_map[token.table].name - rid = token.rid - return f"{name}[{rid}]+{rutils.hex(offset)}" + return f"token({rutils.hex(token.value)})+{rutils.hex(offset)}" elif address.type == frz.AddressType.NO_ADDRESS: return "global" else: diff --git a/capa/rules.py b/capa/rules.py index 499eff87..00d9260c 100644 --- a/capa/rules.py +++ b/capa/rules.py @@ -264,13 +264,6 @@ def parse_feature(key: str): return capa.features.insn.Number elif key == "offset": return capa.features.insn.Offset - # TODO remove x32/x64 flavor keys once fixed master/rules - elif key.startswith("number/"): - logger.warning("x32/x64 flavor currently not supported and deprecated") - return capa.features.insn.Number - elif key.startswith("offset/"): - logger.warning("x32/x64 flavor currently not supported and deprecated") - return capa.features.insn.Offset elif key == "mnemonic": return capa.features.insn.Mnemonic elif key == "basic blocks": diff --git a/rules b/rules index cb28b9b8..d2ad3a04 160000 --- a/rules +++ b/rules @@ -1 +1 @@ -Subproject commit cb28b9b8bec419a2d1582542dc93cef001589c78 +Subproject commit d2ad3a045a39e7656ddff7cdec5fc0561816728e diff --git a/setup.py b/setup.py index fdefe2f8..ca9acfd0 100644 --- a/setup.py +++ b/setup.py @@ -87,7 +87,7 @@ setuptools.setup( "types-tabulate==0.8.9", "types-termcolor==1.1.4", "types-psutil==5.8.23", - "types_requests==2.27.30", + "types_requests==2.28.0", ], "build": [ "pyinstaller==5.1",