diff --git a/capa/ida/plugin/form.py b/capa/ida/plugin/form.py index 6b70afd9..a75ff28d 100644 --- a/capa/ida/plugin/form.py +++ b/capa/ida/plugin/form.py @@ -834,6 +834,8 @@ class CapaExplorerForm(idaapi.PluginForm): self.rules_cache = None self.ruleset_cache = None + self.set_view_status_label("Click Analyze to get started...") + logger.info("Reset completed.") def set_rulegen_status(self, e): diff --git a/capa/ida/plugin/view.py b/capa/ida/plugin/view.py index 3e82f058..4f00c977 100644 --- a/capa/ida/plugin/view.py +++ b/capa/ida/plugin/view.py @@ -7,6 +7,7 @@ # See the License for the specific language governing permissions and limitations under the License. from collections import Counter, defaultdict import binascii +import re import idc from PyQt5 import QtCore, QtWidgets, QtGui @@ -243,11 +244,31 @@ class CapaExplorerRulgenEditor(QtWidgets.QTreeWidget): if display.startswith(("- and", "- or", "- optional", "- basic block", "- not")): rule_text += "%s%s\n" % (" " * depth_space, display) rule_text += "%s- description: %s\n" % (" " * (depth_space + 2), description) + continue elif display.startswith("- string"): rule_text += "%s%s\n" % (" " * depth_space, display) rule_text += "%sdescription: %s\n" % (" " * (depth_space + 2), description) - else: - rule_text += "%s%s = %s\n" % (" " * depth_space, display, description) + continue + elif display.startswith("- count"): + # count is weird, we need to format description based on feature type, so we parse with regex + # assume format - count(()): + m = re.search(r"- count\(([a-zA-Z]+)\((.+)\)\): (.+)", display) + if m: + name, value, count = m.groups() + if name in ("string",): + rule_text += "%s%s\n" % (" " * depth_space, display) + rule_text += "%sdescription: %s\n" % (" " * (depth_space + 2), description) + else: + rule_text += "%s- count(%s(%s = %s)): %s\n" % ( + " " * depth_space, + name, + value, + description, + count, + ) + continue + # catchall + rule_text += "%s%s = %s\n" % (" " * depth_space, display, description) self.preview.setPlainText(rule_text)