diff --git a/capa/main.py b/capa/main.py index 32ef811d..e76ff8c6 100644 --- a/capa/main.py +++ b/capa/main.py @@ -548,14 +548,23 @@ def get_signatures(sigs_path): if os.path.isfile(sigs_path): paths.append(sigs_path) elif os.path.isdir(sigs_path): - logger.debug("reading signatures from directory %s", sigs_path) + logger.debug("reading signatures from directory %s", os.path.abspath(os.path.normpath(sigs_path))) for root, dirs, files in os.walk(sigs_path): for file in files: if file.endswith((".pat", ".pat.gz", ".sig")): sig_path = os.path.join(root, file) - logger.debug("found signature: %s", sig_path) paths.append(sig_path) + # nicely normalize and format path so that debugging messages are clearer + paths = [os.path.abspath(os.path.normpath(path)) for path in paths] + + # load signatures in deterministic order: the alphabetic sorting of filename. + # this means that `0_sigs.pat` loads before `1_sigs.pat`. + paths = sorted(paths, key=os.path.basename) + + for path in paths: + logger.debug("found signature file: %s", path) + return paths diff --git a/sigs/flare_msvc_rtf_32_64.sig b/sigs/1_flare_msvc_rtf_32_64.sig similarity index 100% rename from sigs/flare_msvc_rtf_32_64.sig rename to sigs/1_flare_msvc_rtf_32_64.sig diff --git a/sigs/flare_msvc_atlmfc_32_64.sig b/sigs/2_flare_msvc_atlmfc_32_64.sig similarity index 100% rename from sigs/flare_msvc_atlmfc_32_64.sig rename to sigs/2_flare_msvc_atlmfc_32_64.sig diff --git a/sigs/flare_common_libs.sig b/sigs/3_flare_common_libs.sig similarity index 100% rename from sigs/flare_common_libs.sig rename to sigs/3_flare_common_libs.sig