gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2025-12-22 23:26:21 -08:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' into capafmt

Browse Source
This commit is contained in:
Willi Ballenthin
2020-06-25 07:47:25 -06:00
committed by GitHub
parent aa357855b8 aa88840b5a
commit c8bcc154c5
27 changed files with 303 additions and 292 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
scripts/setup-hooks.sh
View File

@@ -1,4 +1,8 @@
#!/bin/sh
#!/usr/bin/env bash
set -e
set -u
set -o pipefail
GIT_DIR=`git rev-parse --show-toplevel`
cd $GIT_DIR
@@ -8,9 +12,9 @@ cd $GIT_DIR
# After that append `scripts/hooks/$arg` and ensure they can be run
create_hook() {
if [[ ! -e .git/hooks/$1 ]]; then
echo '#!/bin/sh' > .git/hooks/$1
echo "#!/bin/sh" > ".git/hooks/$1"
fi
cat scripts/hooks/$1 >> .git/hooks/$1
cat scripts/hooks/$1 >> ".git/hooks/$1"
chmod +x .git/hooks/$1
}
@@ -19,7 +23,6 @@ create_hook 'post-commit'
create_hook 'pre-push'
echo '\n#### Installing linter/test dependencies\n'
pip install pycodestyle
pytest-sugar
pip install pycodestyle pytest-sugar
pip install https://github.com/williballenthin/vivisect/zipball/master
python setup.py develop

16
scripts/show-features.py
View File

@@ -28,13 +28,13 @@ def main(argv=None):
]
format_help = ', '.join(['%s: %s' % (f[0], f[1]) for f in formats])
parser = argparse.ArgumentParser(description="detect capabilities in programs.")
parser.add_argument("sample", type=str,
help="Path to sample to analyze")
parser.add_argument("-f", "--format", choices=[f[0] for f in formats], default="auto",
help="Select sample format, %s" % format_help)
parser.add_argument("-F", "--function", type=lambda x: int(x, 0),
help="Show features for specific function")
parser = argparse.ArgumentParser(description='detect capabilities in programs.')
parser.add_argument('sample', type=str,
help='Path to sample to analyze')
parser.add_argument('-f', '--format', choices=[f[0] for f in formats], default='auto',
help='Select sample format, %s' % format_help)
parser.add_argument('-F', '--function', type=lambda x: int(x, 0),
help='Show features for specific function')
args = parser.parse_args(args=argv)
logging.basicConfig(level=logging.INFO)
@@ -77,5 +77,5 @@ def main(argv=None):
return 0
if __name__ == "__main__":
if __name__ == '__main__':
sys.exit(main())

6
scripts/testbed/_dump_fnames.py
View File

@@ -26,7 +26,7 @@ def main():
fnames = {}
for f in idautils.Functions():
fname = idc.get_name(f)
if fname.startswith("sub_"):
if fname.startswith('sub_'):
continue
name_demangled = idc.demangle_name(fname, INF_SHORT_DN_ATTR)
@@ -35,12 +35,12 @@ def main():
fnames[f] = fname
with open(idc.ARGV[1], "w") as f:
with open(idc.ARGV[1], 'w') as f:
json.dump(fnames, f)
# exit IDA
idc.qexit(0)
if __name__ == "__main__":
if __name__ == '__main__':
main()

2
scripts/testbed/_export_fimages.py
View File

@@ -40,5 +40,5 @@ def main():
idc.qexit(0)
if __name__ == "__main__":
if __name__ == '__main__':
main()

20
scripts/testbed/freeze_features.py
View File

@@ -66,15 +66,15 @@ def main(argv=None):
if argv is None:
argv = sys.argv[1:]
parser = argparse.ArgumentParser(description="Freeze capa features of a file or of files in a directory")
parser.add_argument("file_path", type=str,
help="Path to file or directory to analyze")
parser.add_argument("-r", "--reprocess", action="store_true", default=False,
help="Overwrite existing analysis")
parser.add_argument("-v", "--verbose", action="store_true",
help="Enable verbose output")
parser.add_argument("-q", "--quiet", action="store_true",
help="Disable all output but errors")
parser = argparse.ArgumentParser(description='Freeze capa features of a file or of files in a directory')
parser.add_argument('file_path', type=str,
help='Path to file or directory to analyze')
parser.add_argument('-r', '--reprocess', action='store_true', default=False,
help='Overwrite existing analysis')
parser.add_argument('-v', '--verbose', action='store_true',
help='Enable verbose output')
parser.add_argument('-q', '--quiet', action='store_true',
help='Disable all output but errors')
args = parser.parse_args(args=argv)
if args.quiet:
@@ -98,5 +98,5 @@ def main(argv=None):
return 0
if __name__ == "__main__":
if __name__ == '__main__':
sys.exit(main())

36
scripts/testbed/run_rule_on_testbed.py
View File

@@ -217,23 +217,23 @@ def main(argv=None):
if argv is None:
argv = sys.argv[1:]
parser = argparse.ArgumentParser(description="Run capa rule file against frozen features in a directory")
parser.add_argument("rules", type=str,
help="Path to directory containing rules")
parser.add_argument("rule_name", type=str,
help="Name of rule to test")
parser.add_argument("frozen_path", type=str,
help="Path to frozen feature file or directory")
parser.add_argument("-f", "--fast", action="store_true",
help="Don't test slow files")
parser.add_argument("-o", "--only_matching", action="store_true",
help="Print only if rule matches")
parser.add_argument("-s", "--save_image", action="store",
help="Directory to save exported images of function graphs")
parser.add_argument("-v", "--verbose", action="count", default=0,
help="Increase output verbosity")
parser.add_argument("-q", "--quiet", action="store_true",
help="Disable all output but errors")
parser = argparse.ArgumentParser(description='Run capa rule file against frozen features in a directory')
parser.add_argument('rules', type=str,
help='Path to directory containing rules')
parser.add_argument('rule_name', type=str,
help='Name of rule to test')
parser.add_argument('frozen_path', type=str,
help='Path to frozen feature file or directory')
parser.add_argument('-f', '--fast', action='store_true',
help='Don't test slow files')
parser.add_argument('-o', '--only_matching', action='store_true',
help='Print only if rule matches')
parser.add_argument('-s', '--save_image', action='store',
help='Directory to save exported images of function graphs')
parser.add_argument('-v', '--verbose', action='count', default=0,
help='Increase output verbosity')
parser.add_argument('-q', '--quiet', action='store_true',
help='Disable all output but errors')
args = parser.parse_args(args=argv)
if args.quiet:
@@ -293,5 +293,5 @@ def main(argv=None):
print_summary(args.verbose, time0)
if __name__ == "__main__":
if __name__ == '__main__':
sys.exit(main())

16
scripts/testbed/start_ida_dump_fnames.py
View File

@@ -85,13 +85,13 @@ def get_function_names(fnames_file):
def main():
parser = argparse.ArgumentParser(
description="Launch IDA Pro in autonomous mode to dump function names of a file or of files in a directory")
parser.add_argument("file_path", type=str,
help="File or directory path to analyze")
parser.add_argument("-r", "--reprocess", action="store_true", default=False,
help="Overwrite existing analysis")
parser.add_argument("-v", "--verbose", action="store_true",
help="Enable verbose output")
description='Launch IDA Pro in autonomous mode to dump function names of a file or of files in a directory')
parser.add_argument('file_path', type=str,
help='File or directory path to analyze')
parser.add_argument('-r', '--reprocess', action='store_true', default=False,
help='Overwrite existing analysis')
parser.add_argument('-v', '--verbose', action='store_true',
help='Enable verbose output')
args = parser.parse_args(args=sys.argv[1:])
if args.verbose:
@@ -127,5 +127,5 @@ def main():
return 0
if __name__ == "__main__":
if __name__ == '__main__':
sys.exit(main())

24
scripts/testbed/start_ida_export_fimages.py
View File

@@ -101,17 +101,17 @@ def get_md5_hexdigest(sample_path):
def main():
parser = argparse.ArgumentParser(
description="Launch IDA Pro in autonomous mode to export images of function graphs")
parser.add_argument("file_path", type=str,
help="File to export from")
parser.add_argument("out_dir", type=str,
help="Export target directory")
parser.add_argument("-f", "--functions", action="store",
help="Comma separated list of functions to export")
parser.add_argument("-m", "--manual", action="store_true",
help="Manual mode: show IDA dialog boxes")
parser.add_argument("-v", "--verbose", action="store_true",
help="Enable verbose output")
description='Launch IDA Pro in autonomous mode to export images of function graphs')
parser.add_argument('file_path', type=str,
help='File to export from')
parser.add_argument('out_dir', type=str,
help='Export target directory')
parser.add_argument('-f', '--functions', action='store',
help='Comma separated list of functions to export')
parser.add_argument('-m', '--manual', action='store_true',
help='Manual mode: show IDA dialog boxes')
parser.add_argument('-v', '--verbose', action='store_true',
help='Enable verbose output')
args = parser.parse_args(args=sys.argv[1:])
if args.verbose:
@@ -131,5 +131,5 @@ def main():
return 0
if __name__ == "__main__":
if __name__ == '__main__':
sys.exit(main())