From d520bfc7532aad37a08cf2a65e690e69d1e8a37b Mon Sep 17 00:00:00 2001 From: Yacine Elhamer Date: Thu, 20 Jul 2023 11:19:54 +0100 Subject: [PATCH] fix bugs and add copyrights --- capa/features/extractors/cape/extractor.py | 3 ++- capa/features/extractors/cape/file.py | 2 +- capa/features/extractors/cape/global_.py | 2 +- capa/features/extractors/cape/helpers.py | 3 ++- capa/features/extractors/cape/process.py | 3 ++- capa/features/extractors/cape/thread.py | 2 +- capa/helpers.py | 3 ++- capa/main.py | 6 ++---- capa/rules/__init__.py | 2 +- tests/fixtures.py | 10 +++++++--- tests/test_cape_features.py | 3 ++- 11 files changed, 23 insertions(+), 16 deletions(-) diff --git a/capa/features/extractors/cape/extractor.py b/capa/features/extractors/cape/extractor.py index 48bf2a57..5758d0bd 100644 --- a/capa/features/extractors/cape/extractor.py +++ b/capa/features/extractors/cape/extractor.py @@ -1,10 +1,11 @@ -# Copyright (C) 2020 Mandiant, Inc. All Rights Reserved. +# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at: [package root]/LICENSE.txt # Unless required by applicable law or agreed to in writing, software distributed under the License # is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and limitations under the License. + import logging from typing import Dict, Tuple, Union, Iterator diff --git a/capa/features/extractors/cape/file.py b/capa/features/extractors/cape/file.py index 5cacb5f6..61a8c790 100644 --- a/capa/features/extractors/cape/file.py +++ b/capa/features/extractors/cape/file.py @@ -1,4 +1,4 @@ -# Copyright (C) 2020 Mandiant, Inc. All Rights Reserved. +# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at: [package root]/LICENSE.txt diff --git a/capa/features/extractors/cape/global_.py b/capa/features/extractors/cape/global_.py index 4a07e8c6..6e3c4f63 100644 --- a/capa/features/extractors/cape/global_.py +++ b/capa/features/extractors/cape/global_.py @@ -1,4 +1,4 @@ -# Copyright (C) 2020 Mandiant, Inc. All Rights Reserved. +# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at: [package root]/LICENSE.txt diff --git a/capa/features/extractors/cape/helpers.py b/capa/features/extractors/cape/helpers.py index 6595c0b1..31dc6c91 100644 --- a/capa/features/extractors/cape/helpers.py +++ b/capa/features/extractors/cape/helpers.py @@ -1,10 +1,11 @@ -# Copyright (C) 2020 Mandiant, Inc. All Rights Reserved. +# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at: [package root]/LICENSE.txt # Unless required by applicable law or agreed to in writing, software distributed under the License # is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and limitations under the License. + from typing import Any, Dict, List from capa.features.extractors.base_extractor import ProcessHandle diff --git a/capa/features/extractors/cape/process.py b/capa/features/extractors/cape/process.py index 99519b37..4c1babe9 100644 --- a/capa/features/extractors/cape/process.py +++ b/capa/features/extractors/cape/process.py @@ -1,10 +1,11 @@ -# Copyright (C) 2020 Mandiant, Inc. All Rights Reserved. +# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at: [package root]/LICENSE.txt # Unless required by applicable law or agreed to in writing, software distributed under the License # is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and limitations under the License. + import logging from typing import Dict, List, Tuple, Iterator diff --git a/capa/features/extractors/cape/thread.py b/capa/features/extractors/cape/thread.py index bc45a169..0f25172c 100644 --- a/capa/features/extractors/cape/thread.py +++ b/capa/features/extractors/cape/thread.py @@ -1,4 +1,4 @@ -# Copyright (C) 2020 Mandiant, Inc. All Rights Reserved. +# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at: [package root]/LICENSE.txt diff --git a/capa/helpers.py b/capa/helpers.py index 3f86aace..d11a44cf 100644 --- a/capa/helpers.py +++ b/capa/helpers.py @@ -54,7 +54,8 @@ def assert_never(value) -> NoReturn: def get_format_from_report(sample: Path) -> str: with open(sample.name, "rb") as f: report = json.load(f) - if "CAPE" in report.keys(): + report = json.load(sample.open()) + if "CAPE" in report: return FORMAT_CAPE return FORMAT_UNKNOWN diff --git a/capa/main.py b/capa/main.py index b7cf0d35..5a0a67c4 100644 --- a/capa/main.py +++ b/capa/main.py @@ -563,8 +563,7 @@ def get_extractor( if format_ == FORMAT_CAPE: import capa.features.extractors.cape.extractor - with open(path, "rb") as f: - report = json.load(f) + report = json.load(Path(path).open()) return capa.features.extractors.cape.extractor.CapeExtractor.from_report(report) elif format_ == FORMAT_DOTNET: @@ -640,8 +639,7 @@ def get_file_extractors(sample: Path, format_: str) -> List[FeatureExtractor]: file_extractors.append(capa.features.extractors.elffile.ElfFeatureExtractor(sample)) elif format_ == FORMAT_CAPE: - with open(sample, "rb") as f: - report = json.load(f) + report = json.load(Path(sample).open()) file_extractors.append(capa.features.extractors.cape.extractor.CapeExtractor.from_report(report)) return file_extractors diff --git a/capa/rules/__init__.py b/capa/rules/__init__.py index 899e97d8..aebcab78 100644 --- a/capa/rules/__init__.py +++ b/capa/rules/__init__.py @@ -118,7 +118,7 @@ class Scopes: dynamic: str def __contains__(self, scope: Union[Scope, str]) -> bool: - assert isinstance(scope, Scope) or isinstance(scope, str) + assert isinstance(scope, (Scope, str)) return (scope == self.static) or (scope == self.dynamic) @classmethod diff --git a/tests/fixtures.py b/tests/fixtures.py index 4a4b1044..a0f4a388 100644 --- a/tests/fixtures.py +++ b/tests/fixtures.py @@ -337,10 +337,14 @@ def get_data_path_by_name(name) -> Path: elif name.startswith("294b8d"): return CD / "data" / "294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc.elf_" elif name.startswith("2bf18d"): - return os.path.join(CD, "data", "2bf18d0403677378adad9001b1243211.elf_") + return CD / "data" / "2bf18d0403677378adad9001b1243211.elf_" elif name.startswith("0000a657"): - return os.path.join( - CD, "data", "dynamic", "cape", "0000a65749f5902c4d82ffa701198038f0b4870b00a27cfca109f8f933476d82.json.gz" + return ( + CD + / "data" + / "dynamic" + / "cape" + / "0000a65749f5902c4d82ffa701198038f0b4870b00a27cfca109f8f933476d82.json.gz" ) elif name.startswith("ea2876"): return CD / "data" / "ea2876e9175410b6f6719f80ee44b9553960758c7d0f7bed73c0fe9a78d8e669.dll_" diff --git a/tests/test_cape_features.py b/tests/test_cape_features.py index 8501aac9..6dc833c0 100644 --- a/tests/test_cape_features.py +++ b/tests/test_cape_features.py @@ -1,10 +1,11 @@ -# Copyright (C) 2020 Mandiant, Inc. All Rights Reserved. +# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at: [package root]/LICENSE.txt # Unless required by applicable law or agreed to in writing, software distributed under the License # is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and limitations under the License. + import fixtures