This commit is contained in:
William Ballenthin
2021-06-09 22:22:03 -06:00
parent ac59e50b5f
commit 954ed3a408
13 changed files with 21 additions and 21 deletions

View File

@@ -12,6 +12,7 @@ import idautils
import capa.features.extractors.helpers import capa.features.extractors.helpers
import capa.features.extractors.ida.helpers import capa.features.extractors.ida.helpers
from capa.features.insn import API, Number, Offset, Mnemonic
from capa.features.common import ( from capa.features.common import (
ARCH_X32, ARCH_X32,
ARCH_X64, ARCH_X64,
@@ -21,7 +22,6 @@ from capa.features.common import (
String, String,
Characteristic, Characteristic,
) )
from capa.features.insn import API, Number, Offset, Mnemonic
# security cookie checks may perform non-zeroing XORs, these are expected within a certain # security cookie checks may perform non-zeroing XORs, these are expected within a certain
# byte range within the first and returning basic blocks, this helps to reduce FP features # byte range within the first and returning basic blocks, this helps to reduce FP features

View File

@@ -3,8 +3,8 @@ import lief
import capa.features.extractors.helpers import capa.features.extractors.helpers
import capa.features.extractors.strings import capa.features.extractors.strings
from capa.features.common import String, Characteristic
from capa.features.file import Export, Import, Section from capa.features.file import Export, Import, Section
from capa.features.common import String, Characteristic
def extract_file_embedded_pe(smda_report, file_path): def extract_file_embedded_pe(smda_report, file_path):

View File

@@ -5,6 +5,7 @@ import struct
from smda.common.SmdaReport import SmdaReport from smda.common.SmdaReport import SmdaReport
import capa.features.extractors.helpers import capa.features.extractors.helpers
from capa.features.insn import API, Number, Offset, Mnemonic
from capa.features.common import ( from capa.features.common import (
ARCH_X32, ARCH_X32,
ARCH_X64, ARCH_X64,
@@ -14,7 +15,6 @@ from capa.features.common import (
String, String,
Characteristic, Characteristic,
) )
from capa.features.insn import API, Number, Offset, Mnemonic
# security cookie checks may perform non-zeroing XORs, these are expected within a certain # security cookie checks may perform non-zeroing XORs, these are expected within a certain
# byte range within the first and returning basic blocks, this helps to reduce FP features # byte range within the first and returning basic blocks, this helps to reduce FP features

View File

@@ -13,8 +13,8 @@ import viv_utils.flirt
import capa.features.insn import capa.features.insn
import capa.features.extractors.helpers import capa.features.extractors.helpers
import capa.features.extractors.strings import capa.features.extractors.strings
from capa.features.common import String, Characteristic
from capa.features.file import Export, Import, Section, FunctionName from capa.features.file import Export, Import, Section, FunctionName
from capa.features.common import String, Characteristic
def extract_file_embedded_pe(vw, file_path): def extract_file_embedded_pe(vw, file_path):

View File

@@ -11,13 +11,14 @@ import viv_utils
import envi.memory import envi.memory
import viv_utils.flirt import viv_utils.flirt
import envi.archs.i386.regs import envi.archs.i386.regs
import envi.archs.i386.disasm
import envi.archs.amd64.regs import envi.archs.amd64.regs
import envi.archs.i386.disasm
import envi.archs.amd64.disasm import envi.archs.amd64.disasm
import capa.features.extractors.viv import capa.features.extractors.viv
import capa.features.extractors.helpers import capa.features.extractors.helpers
import capa.features.extractors.viv.helpers import capa.features.extractors.viv.helpers
from capa.features.insn import API, Number, Offset, Mnemonic
from capa.features.common import ( from capa.features.common import (
ARCH_X32, ARCH_X32,
ARCH_X64, ARCH_X64,
@@ -27,7 +28,6 @@ from capa.features.common import (
String, String,
Characteristic, Characteristic,
) )
from capa.features.insn import API, Number, Offset, Mnemonic
from capa.features.extractors.viv.indirect_calls import NotFoundError, resolve_indirect_call from capa.features.extractors.viv.indirect_calls import NotFoundError, resolve_indirect_call
# security cookie checks may perform non-zeroing XORs, these are expected within a certain # security cookie checks may perform non-zeroing XORs, these are expected within a certain

View File

@@ -22,10 +22,10 @@ import capa.main
import capa.rules import capa.rules
import capa.engine import capa.engine
import capa.ida.helpers import capa.ida.helpers
import capa.features.common
import capa.features.extractors.ida.extractor
import capa.render.json import capa.render.json
import capa.features.common
import capa.render.result_document import capa.render.result_document
import capa.features.extractors.ida.extractor
from capa.ida.plugin.icon import QICON from capa.ida.plugin.icon import QICON
from capa.ida.plugin.view import ( from capa.ida.plugin.view import (
CapaExplorerQtreeView, CapaExplorerQtreeView,
@@ -773,7 +773,9 @@ class CapaExplorerForm(idaapi.PluginForm):
update_wait_box("rendering results") update_wait_box("rendering results")
try: try:
self.doc = capa.render.result_document.convert_capabilities_to_result_document(meta, self.ruleset_cache, capabilities) self.doc = capa.render.result_document.convert_capabilities_to_result_document(
meta, self.ruleset_cache, capabilities
)
except Exception as e: except Exception as e:
logger.error("Failed to render results (error: %s)", e) logger.error("Failed to render results (error: %s)", e)
return False return False

View File

@@ -14,8 +14,8 @@ from PyQt5 import QtGui, QtCore
import capa.rules import capa.rules
import capa.ida.helpers import capa.ida.helpers
import capa.features.common
import capa.render.utils as rutils import capa.render.utils as rutils
import capa.features.common
from capa.ida.plugin.item import ( from capa.ida.plugin.item import (
CapaExplorerDataItem, CapaExplorerDataItem,
CapaExplorerRuleItem, CapaExplorerRuleItem,

View File

@@ -11,8 +11,8 @@ import tabulate
import capa.rules import capa.rules
import capa.render.utils as rutils import capa.render.utils as rutils
import capa.render.verbose import capa.render.verbose
import capa.render.result_document
import capa.features.common import capa.features.common
import capa.render.result_document
def render_locations(ostream, match): def render_locations(ostream, match):

View File

@@ -26,12 +26,12 @@ import ruamel.yaml
import capa.rules import capa.rules
import capa.engine import capa.engine
import capa.engine as ceng
import capa.features import capa.features
import capa.features.file import capa.features.file
import capa.features.insn import capa.features.insn
import capa.features.common import capa.features.common
import capa.features.basicblock import capa.features.basicblock
import capa.engine as ceng
from capa.features.common import MAX_BYTES_FEATURE_SIZE from capa.features.common import MAX_BYTES_FEATURE_SIZE
logger = logging.getLogger(__name__) logger = logging.getLogger(__name__)

View File

@@ -61,8 +61,8 @@ import capa.rules
import capa.engine import capa.engine
import capa.features import capa.features
import capa.render.utils as rutils import capa.render.utils as rutils
import capa.render.result_document
import capa.features.freeze import capa.features.freeze
import capa.render.result_document
from capa.helpers import get_file_taste from capa.helpers import get_file_taste
logger = logging.getLogger("capa.show-capabilities-by-function") logger = logging.getLogger("capa.show-capabilities-by-function")

View File

@@ -12,10 +12,10 @@ from fixtures import *
import capa.main import capa.main
import capa.rules import capa.rules
import capa.helpers import capa.helpers
import capa.features.insn
import capa.features.file import capa.features.file
import capa.features.freeze import capa.features.insn
import capa.features.common import capa.features.common
import capa.features.freeze
import capa.features.basicblock import capa.features.basicblock
import capa.features.extractors.base_extractor import capa.features.extractors.base_extractor

View File

@@ -6,13 +6,12 @@
# is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and limitations under the License. # See the License for the specific language governing permissions and limitations under the License.
import pytest import pytest
import capa.features.file
import fixtures import fixtures
from fixtures import * from fixtures import *
from fixtures import parametrize from fixtures import parametrize
import capa.features.file
@parametrize( @parametrize(
"sample,scope,feature,expected", "sample,scope,feature,expected",

View File

@@ -6,13 +6,12 @@
# is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and limitations under the License. # See the License for the specific language governing permissions and limitations under the License.
import pytest import pytest
import capa.features.file
import fixtures import fixtures
from fixtures import * from fixtures import *
from fixtures import parametrize from fixtures import parametrize
import capa.features.file
@parametrize( @parametrize(
"sample,scope,feature,expected", "sample,scope,feature,expected",