gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2025-12-23 07:28:34 -08:00
Code Issues Packages Projects Releases Wiki Activity

fix bugs and add copyrights

Browse Source
This commit is contained in:
Yacine Elhamer
2023-07-20 11:19:54 +01:00
parent 301b10d261
commit d520bfc753
11 changed files with 23 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
capa/features/extractors/cape/extractor.py
View File

@@ -1,10 +1,11 @@
# Copyright (C) 2020 Mandiant, Inc. All Rights Reserved. # Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
# Licensed under the Apache License, Version 2.0 (the "License"); # Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License. # you may not use this file except in compliance with the License.
# You may obtain a copy of the License at: [package root]/LICENSE.txt # You may obtain a copy of the License at: [package root]/LICENSE.txt
# Unless required by applicable law or agreed to in writing, software distributed under the License # Unless required by applicable law or agreed to in writing, software distributed under the License
# is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and limitations under the License. # See the License for the specific language governing permissions and limitations under the License.
import logging import logging
from typing import Dict, Tuple, Union, Iterator from typing import Dict, Tuple, Union, Iterator

2
capa/features/extractors/cape/file.py
View File

@@ -1,4 +1,4 @@
# Copyright (C) 2020 Mandiant, Inc. All Rights Reserved. # Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
# Licensed under the Apache License, Version 2.0 (the "License"); # Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License. # you may not use this file except in compliance with the License.
# You may obtain a copy of the License at: [package root]/LICENSE.txt # You may obtain a copy of the License at: [package root]/LICENSE.txt

2
capa/features/extractors/cape/global_.py
View File

@@ -1,4 +1,4 @@
# Copyright (C) 2020 Mandiant, Inc. All Rights Reserved. # Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
# Licensed under the Apache License, Version 2.0 (the "License"); # Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License. # you may not use this file except in compliance with the License.
# You may obtain a copy of the License at: [package root]/LICENSE.txt # You may obtain a copy of the License at: [package root]/LICENSE.txt

3
capa/features/extractors/cape/helpers.py
View File

@@ -1,10 +1,11 @@
# Copyright (C) 2020 Mandiant, Inc. All Rights Reserved. # Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
# Licensed under the Apache License, Version 2.0 (the "License"); # Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License. # you may not use this file except in compliance with the License.
# You may obtain a copy of the License at: [package root]/LICENSE.txt # You may obtain a copy of the License at: [package root]/LICENSE.txt
# Unless required by applicable law or agreed to in writing, software distributed under the License # Unless required by applicable law or agreed to in writing, software distributed under the License
# is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and limitations under the License. # See the License for the specific language governing permissions and limitations under the License.
from typing import Any, Dict, List from typing import Any, Dict, List
from capa.features.extractors.base_extractor import ProcessHandle from capa.features.extractors.base_extractor import ProcessHandle

3
capa/features/extractors/cape/process.py
View File

@@ -1,10 +1,11 @@
# Copyright (C) 2020 Mandiant, Inc. All Rights Reserved. # Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
# Licensed under the Apache License, Version 2.0 (the "License"); # Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License. # you may not use this file except in compliance with the License.
# You may obtain a copy of the License at: [package root]/LICENSE.txt # You may obtain a copy of the License at: [package root]/LICENSE.txt
# Unless required by applicable law or agreed to in writing, software distributed under the License # Unless required by applicable law or agreed to in writing, software distributed under the License
# is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and limitations under the License. # See the License for the specific language governing permissions and limitations under the License.
import logging import logging
from typing import Dict, List, Tuple, Iterator from typing import Dict, List, Tuple, Iterator

2
capa/features/extractors/cape/thread.py
View File

@@ -1,4 +1,4 @@
# Copyright (C) 2020 Mandiant, Inc. All Rights Reserved. # Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
# Licensed under the Apache License, Version 2.0 (the "License"); # Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License. # you may not use this file except in compliance with the License.
# You may obtain a copy of the License at: [package root]/LICENSE.txt # You may obtain a copy of the License at: [package root]/LICENSE.txt

3
capa/helpers.py
View File

@@ -54,7 +54,8 @@ def assert_never(value) -> NoReturn:
def get_format_from_report(sample: Path) -> str: def get_format_from_report(sample: Path) -> str:
with open(sample.name, "rb") as f: with open(sample.name, "rb") as f:
report = json.load(f) report = json.load(f)
if "CAPE" in report.keys(): report = json.load(sample.open())
if "CAPE" in report:
return FORMAT_CAPE return FORMAT_CAPE
return FORMAT_UNKNOWN return FORMAT_UNKNOWN

6
capa/main.py
View File

@@ -563,8 +563,7 @@ def get_extractor(
if format_ == FORMAT_CAPE: if format_ == FORMAT_CAPE:
import capa.features.extractors.cape.extractor import capa.features.extractors.cape.extractor
with open(path, "rb") as f: report = json.load(Path(path).open())
report = json.load(f)
return capa.features.extractors.cape.extractor.CapeExtractor.from_report(report) return capa.features.extractors.cape.extractor.CapeExtractor.from_report(report)
elif format_ == FORMAT_DOTNET: elif format_ == FORMAT_DOTNET:
@@ -640,8 +639,7 @@ def get_file_extractors(sample: Path, format_: str) -> List[FeatureExtractor]:
file_extractors.append(capa.features.extractors.elffile.ElfFeatureExtractor(sample)) file_extractors.append(capa.features.extractors.elffile.ElfFeatureExtractor(sample))
elif format_ == FORMAT_CAPE: elif format_ == FORMAT_CAPE:
with open(sample, "rb") as f: report = json.load(Path(sample).open())
report = json.load(f)
file_extractors.append(capa.features.extractors.cape.extractor.CapeExtractor.from_report(report)) file_extractors.append(capa.features.extractors.cape.extractor.CapeExtractor.from_report(report))
return file_extractors return file_extractors

2
capa/rules/__init__.py
View File

@@ -118,7 +118,7 @@ class Scopes:
dynamic: str dynamic: str
def __contains__(self, scope: Union[Scope, str]) -> bool: def __contains__(self, scope: Union[Scope, str]) -> bool:
assert isinstance(scope, Scope) or isinstance(scope, str) assert isinstance(scope, (Scope, str))
return (scope == self.static) or (scope == self.dynamic) return (scope == self.static) or (scope == self.dynamic)
@classmethod @classmethod

10
tests/fixtures.py
View File

@@ -337,10 +337,14 @@ def get_data_path_by_name(name) -> Path:
elif name.startswith("294b8d"): elif name.startswith("294b8d"):
return CD / "data" / "294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc.elf_" return CD / "data" / "294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc.elf_"
elif name.startswith("2bf18d"): elif name.startswith("2bf18d"):
return os.path.join(CD, "data", "2bf18d0403677378adad9001b1243211.elf_") return CD / "data" / "2bf18d0403677378adad9001b1243211.elf_"
elif name.startswith("0000a657"): elif name.startswith("0000a657"):
return os.path.join( return (
CD, "data", "dynamic", "cape", "0000a65749f5902c4d82ffa701198038f0b4870b00a27cfca109f8f933476d82.json.gz" CD
/ "data"
/ "dynamic"
/ "cape"
/ "0000a65749f5902c4d82ffa701198038f0b4870b00a27cfca109f8f933476d82.json.gz"
) )
elif name.startswith("ea2876"): elif name.startswith("ea2876"):
return CD / "data" / "ea2876e9175410b6f6719f80ee44b9553960758c7d0f7bed73c0fe9a78d8e669.dll_" return CD / "data" / "ea2876e9175410b6f6719f80ee44b9553960758c7d0f7bed73c0fe9a78d8e669.dll_"

3
tests/test_cape_features.py
View File

@@ -1,10 +1,11 @@
# Copyright (C) 2020 Mandiant, Inc. All Rights Reserved. # Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
# Licensed under the Apache License, Version 2.0 (the "License"); # Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License. # you may not use this file except in compliance with the License.
# You may obtain a copy of the License at: [package root]/LICENSE.txt # You may obtain a copy of the License at: [package root]/LICENSE.txt
# Unless required by applicable law or agreed to in writing, software distributed under the License # Unless required by applicable law or agreed to in writing, software distributed under the License
# is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and limitations under the License. # See the License for the specific language governing permissions and limitations under the License.
import fixtures import fixtures