From f201ef1d22689df256bbe977840b23fc5a1174fa Mon Sep 17 00:00:00 2001 From: mr-tz Date: Mon, 27 Nov 2023 13:28:06 +0100 Subject: [PATCH 1/2] actually get global feature values --- capa/features/extractors/cape/extractor.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/capa/features/extractors/cape/extractor.py b/capa/features/extractors/cape/extractor.py index d490c446..01a0d8d3 100644 --- a/capa/features/extractors/cape/extractor.py +++ b/capa/features/extractors/cape/extractor.py @@ -41,7 +41,9 @@ class CapeExtractor(DynamicFeatureExtractor): ) ) self.report: CapeReport = report - self.global_features = capa.features.extractors.cape.global_.extract_features(self.report) + + # pre-compute these because we'll yield them at *every* scope. + self.global_features = list(capa.features.extractors.cape.global_.extract_features(self.report)) def get_base_address(self) -> Union[AbsoluteVirtualAddress, _NoAddress, None]: # value according to the PE header, the actual trace may use a different imagebase From 890c879e7cfbc5ebb25a594ee0911adc1b3f4ea3 Mon Sep 17 00:00:00 2001 From: mr-tz Date: Mon, 27 Nov 2023 13:28:36 +0100 Subject: [PATCH 2/2] only check and display file limitation once --- capa/main.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/capa/main.py b/capa/main.py index bfc84fb2..a7ac5b7b 100644 --- a/capa/main.py +++ b/capa/main.py @@ -1101,6 +1101,7 @@ def main(argv: Optional[List[str]] = None): else: log_unsupported_format_error() + found_file_limitation = False for file_extractor in file_extractors: if isinstance(file_extractor, DynamicFeatureExtractor): # Dynamic feature extractors can handle packed samples @@ -1117,7 +1118,8 @@ def main(argv: Optional[List[str]] = None): # file limitations that rely on non-file scope won't be detected here. # nor on FunctionName features, because pefile doesn't support this. - if has_file_limitation(rules, pure_file_capabilities): + found_file_limitation = has_file_limitation(rules, pure_file_capabilities) + if found_file_limitation: # bail if capa encountered file limitation e.g. a packed binary # do show the output in verbose mode, though. if not (args.verbose or args.vverbose or args.json):