gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2026-07-28 22:50:59 -07:00
Code Issues Packages Projects Releases Wiki Activity
4,061 Commits 53 Branches 49 Tags
arm-support
Commit Graph
47 Commits
Author SHA1 Message Date
Willi Ballenthin c86ab51210 fix copyright headers everywhere 2023-07-13 05:03:33 +02:00
Aayush Goel ef39bc3c3a Merged Changes from PR #1591 2023-07-11 01:14:38 +05:30
Aayush Goel 8e346cb411 Merge branch 'Aayush-Goel-04/Issue#1534' of https://github.com/Aayush-Goel-04/capa into Aayush-Goel-04/Issue#1534 2023-07-11 00:59:21 +05:30
Aayush Goel 673af45c55 Update args.sample type to Path and str vs as_posix comparisons 2023-07-09 16:02:28 +05:30
Aayush Goel edeb458b33 some more changes 2023-07-07 12:03:05 +05:30
Willi Ballenthin 13a8e252f0 introduce flake8-comprehensions 2023-07-06 20:04:27 +02:00
Willi Ballenthin 9441da4887 isort 2023-07-06 17:50:34 +02:00
Willi Ballenthin 47074fd129 fix ruff issues 2023-07-06 17:49:40 +02:00
Aayush Goel c0d712acea Changes os.path to pathlib.Path usage 
changed args.rules , args.signatures types in handle_common_args.
 2023-07-06 05:12:50 +05:30
Aayush Goel b4870b120e Remove from_capa API for MetaData 2023-06-03 15:33:49 +05:30
Aayush Goel 445214b23b Update Metadata type in capa main 2023-06-02 00:40:38 +05:30
Willi Ballenthin f1c495dc0a *: use FORMAT_AUTO instead of string literal 2023-03-21 16:54:48 +01:00
Willi Ballenthin 1f3582c9c3 mypy 2023-03-21 16:45:24 +01:00
manasghandatGitHubWilli BallenthinMoritz
 		1336796c0c code style : update remaining files (#1353) 
* code style: update string formatting using fstrings

---------

Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
 2023-03-16 11:16:18 +01:00
MoritzGitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		6a222a6139 Update black (#1307) 
* build(deps-dev): bump black from 22.12.0 to 23.1.0

Bumps [black](https://github.com/psf/black) from 22.12.0 to 23.1.0.
- [Release notes](https://github.com/psf/black/releases)
- [Changelog](https://github.com/psf/black/blob/main/CHANGES.md)
- [Commits](https://github.com/psf/black/compare/22.12.0...23.1.0)

---
updated-dependencies:
- dependency-name: black
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* reformat black 23.1.0

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-02-07 15:50:15 +01:00
Willi Ballenthin 67cfefd2df main: get_rules: remove progress bar 2023-01-21 19:38:23 +01:00
Willi Ballenthin 476ffabae9 rules: cache the ruleset to disk 
ref: #1212
 2023-01-20 14:50:00 +01:00
Josh Soref 68efa7316b spelling: dictionary 
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>
 2023-01-04 00:25:22 -05:00
Willi Ballenthin b819033da0 lots of mypy 2022-12-14 10:37:39 +01:00
Willi Ballenthin e7cf69a82e pep8 2022-06-28 15:58:02 -06:00
Willi Ballenthin 91818a116d scripts/capa_as_library: use new ResultDocument 
closes #1071
 2022-06-28 15:53:37 -06:00
Willi Ballenthin aff72ad983 capa_as_library: fix rules path is list now 2022-04-06 11:07:34 -06:00
re-foxandGitHub 37f51690d0 Update capa_as_library.py 2022-02-13 13:09:58 -05:00
William Ballenthin 4451b76f89 pep8 2021-10-26 15:21:28 -06:00
William Ballenthin 328e13fbfe main: compute function & bb layout 
so bb can be associated with function in output.
only captures BBs that have a rule match,
otherwise, there might be too much data captured.
closes #130.
 2021-10-26 15:04:50 -06:00
William Ballenthin 1b9a6c3c59 main: collect os/format/arch into metadata and render it 2021-08-20 16:50:40 -06:00
doomedravenandGitHub b1171864e3 black 2021-08-18 14:25:58 +02:00
doomedravenandGitHub 5af59cecda update capa_as_library for capa v2 2021-08-18 14:23:36 +02:00
William Ballenthin a7ebd5a309 Merge branch 'master' of github.com:fireeye/capa into fix-507 2021-06-15 12:28:17 -06:00
William Ballenthin 7f03db9fe4 main: dont save .viv by default, unless CAPA_SAVE_WORKSPACE set 
closes #507
 2021-06-15 12:24:01 -06:00
William Ballenthin aca6ad2f52 scripts: fix types 2021-06-14 10:41:44 -06:00
William Ballenthin ac59e50b5f move capa/features/__init__.py logic to common.py 
also cleanup imports across the board,
thanks to pylance.
 2021-06-09 22:20:53 -06:00
William Ballenthin 766dcacdbe move logic out of capa/render/__init__.py 2021-06-09 18:06:51 -06:00
William Ballenthin 1ee7b7b856 merge master 2021-03-05 15:23:47 -07:00
William Ballenthin eacd70329a merge from master, sorry 2021-03-05 11:06:40 -07:00
William Ballenthin 3a1d5d068c scripts: use common argument handler 
closes #449
 2021-03-05 10:58:40 -07:00
William Ballenthin c2a4629c62 scripts: add cli arguments to specify signatures 2021-03-04 15:04:33 -07:00
Ana Maria Martinez Gomez 40ed2f39a4 Make backend a required parameter in get_extractor 
Make the `backend` argument required in the `get_extractor` internal
routine. Specify a backend in the scripts which call this function. Add
a CLI backend option in capa/features/freeze.py as well.
 2021-03-03 17:36:50 +01:00
Ana Maria Martinez Gomez d28ba3c628 Make backend a required parameter in get_extractor 
Make the `backend` argument required in the `get_extractor` internal
routine. Specify a backend in the scripts which call this function. Add
a CLI backend option in capa/features/freeze.py as well.
 2021-02-25 10:04:19 +01:00
DoomedRaven e158e3f13c remove type hint to make CI happy 2020-12-08 21:46:39 +01:00
DoomedRaven b1bbded23c black -l 120 . 2020-12-08 21:39:50 +01:00
DoomedRaven b77d9d3738 isort --profile black --length-sort --line-width 120 capa_as_library.py 2020-12-08 21:34:42 +01:00
DoomedRaven d0b2421752 isort capa_as_library.py 2020-12-08 20:53:26 +01:00
DoomedRaven 96b65a7c60 add example how to render it as library 
```
>>> from capa_as_library import capa_details
>>> details = capa_details("/opt/CAPEv2/storage/analyses/83/binary", "dictionary")
>>> from pprint import pprint as pp
>>> pp(details)
{'ATTCK': {'DEFENSE EVASION': ['Obfuscated Files or Information [T1027]',
                               'Virtualization/Sandbox Evasion::System Checks '
                               '[T1497.001]'],
           'EXECUTION': ['Shared Modules [T1129]']},
 'CAPABILITY': {'anti-analysis/anti-vm/vm-detection': ['execute anti-VM '
                                                       'instructions (3 '
                                                       'matches)'],
                'anti-analysis/obfuscation/string/stackstring': ['contain '
                                                                 'obfuscated '
                                                                 'stackstrings'],
                'data-manipulation/encryption/rc4': ['encrypt data using RC4 '
                                                     'PRGA'],
                'executable/pe/section/rsrc': ['contain a resource (.rsrc) '
                                               'section'],
                'host-interaction/cli': ['accept command line arguments'],
                'host-interaction/environment-variable': ['query environment '
                                                          'variable'],
                'host-interaction/file-system/read': ['read .ini file',
                                                      'read file'],
                'host-interaction/file-system/write': ['write file (3 '
                                                       'matches)'],
                'host-interaction/process': ['get thread local storage value '
                                             '(3 matches)',
                                             'set thread local storage value '
                                             '(2 matches)'],
                'host-interaction/process/terminate': ['terminate process (3 '
                                                       'matches)'],
                'host-interaction/thread/terminate': ['terminate thread'],
                'linking/runtime-linking': ['link function at runtime (7 '
                                            'matches)',
                                            'link many functions at runtime'],
                'load-code/pe': ['parse PE header (3 matches)']},
 'MBC': {'ANTI-BEHAVIORAL ANALYSIS': ['Virtual Machine Detection::Instruction '
                                      'Testing [B0009.029]'],
         'ANTI-STATIC ANALYSIS': ['Disassembler Evasion::Argument Obfuscation '
                                  '[B0012.001]'],
         'CRYPTOGRAPHY': ['Encrypt Data::RC4 [C0027.009]',
                          'Generate Pseudo-random Sequence::RC4 PRGA '
                          '[C0021.004]']},
 'md5': 'ad56c384476a81faef9aebd60b2f4623',
 'path': '/opt/CAPEv2/storage/analyses/83/binary',
 'sha1': 'aa027d89f5d3f991ad3e14ffb681616a77621836',
 'sha256': '16995e059eb47de0b58a95ce2c3d863d964a7a16064d4298cee9db1de266e68d'}
>>>
```
 2020-12-08 20:00:24 +01:00
doomedraven 5920552649 small improvements 2020-12-01 20:31:56 +01:00
Willi BallenthinandGitHub eac7e2b749 capa_as_library: style and comments 2020-12-01 06:54:55 -07:00
doomedravenandGitHub 51ad526cfc Simple example how to use capa as library 
Just quick example how to use capa as library, to save time to someone, reading code and scripts
 2020-12-01 11:20:49 +01:00