diff --git a/CHANGELOG.md b/CHANGELOG.md index f0c7281b..25a8750c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -18,6 +18,8 @@ ### capa explorer IDA Pro plugin +- explorer: add additional filter logic when displaying matches by function #686 @mike-hunhoff + ### Development ### Raw diffs diff --git a/capa/ida/plugin/model.py b/capa/ida/plugin/model.py index bd9b8430..96d415ce 100644 --- a/capa/ida/plugin/model.py +++ b/capa/ida/plugin/model.py @@ -435,12 +435,18 @@ class CapaExplorerDataModel(QtCore.QAbstractItemModel): for ea in rule["matches"].keys(): ea = capa.ida.helpers.get_func_start_ea(ea) if ea is None: - # file scope, skip for rendering in this mode + # file scope, skip rendering in this mode continue - if None is matches_by_function.get(ea, None): - matches_by_function[ea] = CapaExplorerFunctionItem(self.root_node, ea, can_check=False) + if not matches_by_function.get(ea, ()): + # new function root + matches_by_function[ea] = (CapaExplorerFunctionItem(self.root_node, ea, can_check=False), []) + function_root, match_cache = matches_by_function[ea] + if rule["meta"]["name"] in match_cache: + # rule match already rendered for this function root, skip it + continue + match_cache.append(rule["meta"]["name"]) CapaExplorerRuleItem( - matches_by_function[ea], + function_root, rule["meta"]["name"], rule["meta"].get("namespace"), len(rule["matches"]),