gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2025-12-22 07:10:29 -08:00
Code Issues Packages Projects Releases Wiki Activity

*: use FORMAT_AUTO instead of string literal

Browse Source
This commit is contained in:
Willi Ballenthin
2023-03-21 16:54:48 +01:00
parent 98eb28704c
commit f1c495dc0a
5 changed files with 13 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
scripts/capa_as_library.py
View File

@@ -14,7 +14,7 @@ import capa.render.default
import capa.render.result_document as rd import capa.render.result_document as rd
import capa.features.freeze.features as frzf import capa.features.freeze.features as frzf
from capa.engine import * from capa.engine import *
from capa.features.common import OS_AUTO from capa.features.common import OS_AUTO, FORMAT_AUTO
# == Render dictionary helpers # == Render dictionary helpers
@@ -166,12 +166,12 @@ def capa_details(rules_path, file_path, output_format="dictionary"):
# extract features and find capabilities # extract features and find capabilities
extractor = capa.main.get_extractor( extractor = capa.main.get_extractor(
file_path, "auto", OS_AUTO, capa.main.BACKEND_VIV, [], False, disable_progress=True file_path, FORMAT_AUTO, OS_AUTO, capa.main.BACKEND_VIV, [], False, disable_progress=True
) )
capabilities, counts = capa.main.find_capabilities(rules, extractor, disable_progress=True) capabilities, counts = capa.main.find_capabilities(rules, extractor, disable_progress=True)
# collect metadata (used only to make rendering more complete) # collect metadata (used only to make rendering more complete)
meta = capa.main.collect_metadata([], file_path, "auto", OS_AUTO, rules_path, extractor) meta = capa.main.collect_metadata([], file_path, FORMAT_AUTO, OS_AUTO, rules_path, extractor)
meta["analysis"].update(counts) meta["analysis"].update(counts)
meta["analysis"]["layout"] = capa.main.compute_layout(rules, extractor, capabilities) meta["analysis"]["layout"] = capa.main.compute_layout(rules, extractor, capabilities)

4
scripts/profile-time.py
View File

@@ -99,7 +99,9 @@ def main(argv=None):
logger.error("%s", str(e)) logger.error("%s", str(e))
return -1 return -1
if (args.format == "freeze") or (args.format == "auto" and capa.features.freeze.is_freeze(taste)): if (args.format == "freeze") or (
args.format == capa.features.common.FORMAT_AUTO and capa.features.freeze.is_freeze(taste)
):
with open(args.sample, "rb") as f: with open(args.sample, "rb") as f:
extractor = capa.features.freeze.load(f.read()) extractor = capa.features.freeze.load(f.read())
else: else:

3
scripts/show-capabilities-by-function.py
View File

@@ -68,6 +68,7 @@ import capa.render.verbose
import capa.features.freeze import capa.features.freeze
import capa.render.result_document as rd import capa.render.result_document as rd
from capa.helpers import get_file_taste from capa.helpers import get_file_taste
from capa.features.common import FORMAT_AUTO
from capa.features.freeze import Address from capa.features.freeze import Address
logger = logging.getLogger("capa.show-capabilities-by-function") logger = logging.getLogger("capa.show-capabilities-by-function")
@@ -156,7 +157,7 @@ def main(argv=None):
logger.error("%s", str(e)) logger.error("%s", str(e))
return -1 return -1
if (args.format == "freeze") or (args.format == "auto" and capa.features.freeze.is_freeze(taste)): if (args.format == "freeze") or (args.format == FORMAT_AUTO and capa.features.freeze.is_freeze(taste)):
format_ = "freeze" format_ = "freeze"
with open(args.sample, "rb") as f: with open(args.sample, "rb") as f:
extractor = capa.features.freeze.load(f.read()) extractor = capa.features.freeze.load(f.read())

4
scripts/show-features.py
View File

@@ -113,7 +113,9 @@ def main(argv=None):
logger.error("%s", str(e)) logger.error("%s", str(e))
return -1 return -1
if (args.format == "freeze") or (args.format == "auto" and capa.features.freeze.is_freeze(taste)): if (args.format == "freeze") or (
args.format == capa.features.common.FORMAT_AUTO and capa.features.freeze.is_freeze(taste)
):
with open(args.sample, "rb") as f: with open(args.sample, "rb") as f:
extractor = capa.features.freeze.load(f.read()) extractor = capa.features.freeze.load(f.read())
else: else:

3
tests/fixtures.py
View File

@@ -33,6 +33,7 @@ from capa.features.common import (
ARCH_AMD64, ARCH_AMD64,
FORMAT_ELF, FORMAT_ELF,
OS_WINDOWS, OS_WINDOWS,
FORMAT_AUTO,
FORMAT_DOTNET, FORMAT_DOTNET,
Arch, Arch,
Format, Format,
@@ -105,7 +106,7 @@ def get_viv_extractor(path):
elif "raw64" in path: elif "raw64" in path:
vw = capa.main.get_workspace(path, "sc64", sigpaths=sigpaths) vw = capa.main.get_workspace(path, "sc64", sigpaths=sigpaths)
else: else:
vw = capa.main.get_workspace(path, "auto", sigpaths=sigpaths) vw = capa.main.get_workspace(path, FORMAT_AUTO, sigpaths=sigpaths)
vw.saveWorkspace() vw.saveWorkspace()
extractor = capa.features.extractors.viv.extractor.VivisectFeatureExtractor(vw, path, OS_AUTO) extractor = capa.features.extractors.viv.extractor.VivisectFeatureExtractor(vw, path, OS_AUTO)
fixup_viv(path, extractor) fixup_viv(path, extractor)