diff --git a/README.md b/README.md index 377d766a..c5457c6e 100644 --- a/README.md +++ b/README.md @@ -140,6 +140,12 @@ rule: The [github.com/fireeye/capa-rules](https://github.com/fireeye/capa-rules) repository contains hundreds of standard library rules that are distributed with capa. Please learn to write rules and contribute new entries as you find interesting techniques in malware. +If you use IDA Pro, then you use can use the [IDA Pro plugin for capa](./capa/ida/ida_capa_explorer.py). +This script adds new user interface elements to IDA, including an interactive tree view of rule matches and their locations within the current database. +As you select the checkboxes, the plugin will highlight the addresses associated with the features. +We use this plugin all the time to quickly jump to interesting parts of a program. +![capa + IDA Pro integration](.github/capa-ida.jpg) + # further information ## capa - [doc/installation](doc/installation.md)