Willi Ballenthin
d5e187bc70
Merge branch 'master' into dynamic-feature-extraction
2023-10-19 09:15:57 +00:00
Yacine Elhamer
37caeb2736
capabilities: add a test file for the new capabilities module, and move the corresponding tests from main to there
2023-10-19 10:54:53 +02:00
Yacine Elhamer
5c48f38208
capa/main.py: add a capabilities module and move all of the capability extraction there
2023-10-19 10:39:14 +02:00
Yacine
9609d63f8a
Update tests/test_main.py
...
Co-authored-by: Moritz <mr-tz@users.noreply.github.com >
2023-10-19 08:10:29 +02:00
Willi Ballenthin
1aac4a1a69
mypy
2023-10-17 14:42:58 +00:00
Willi Ballenthin
cb5fa36fc8
flake8
2023-10-17 11:44:48 +00:00
Willi Ballenthin
44d05f9498
dynamic: fix some tests
2023-10-17 11:41:40 +00:00
Willi Ballenthin
182a9868ca
merge master
2023-10-17 10:32:25 +00:00
Aayush Goel
412d296d6b
Merge branch 'mandiant:master' into Aayush-Goel-04/Issue#322
2023-10-16 16:38:18 +05:30
Aayush Goel
db32d90480
tests updated
2023-10-16 16:35:30 +05:30
Capa Bot
40ba6679f0
Sync capa-testfiles submodule
2023-10-11 14:36:05 +00:00
Yacine Elhamer
953b2e82d2
rendering: several fixes and added types/classes
2023-10-11 11:52:16 +02:00
Moritz
a9daa92c9a
Merge branch 'master' into Aayush-Goel-04/Issue#322
2023-10-09 18:22:46 +02:00
Willi Ballenthin
8a019aa360
Merge branch 'master' into test_binja_forwarded_export
2023-09-27 08:48:21 +02:00
Capa Bot
79cef0e783
Sync capa-testfiles submodule
2023-09-22 10:33:01 +00:00
Willi Ballenthin
09b54a86f0
Merge branch 'master' into test_binja_forwarded_export
2023-09-21 12:10:13 +02:00
Xusheng
55af6f052f
binja: add support for symtab names. Fix #1504
2023-09-21 17:24:42 +08:00
Xusheng
d2d32f88ef
binja: add support for forwarded exports
2023-09-21 15:32:55 +08:00
Xusheng
bc71c94171
binja: use binaryninja.load to open a binary
2023-09-21 09:51:01 +08:00
Xusheng
59d03b3ba3
binja: bump Binary Ninja version to 3.5
2023-09-20 21:00:04 +08:00
Capa Bot
d04ae5294e
Sync capa-testfiles submodule
2023-09-13 14:50:29 +00:00
Aayush Goel
8331ed6ea0
Merge branch 'mandiant:master' into Aayush-Goel-04/Issue#322
2023-09-06 16:35:29 +05:30
Willi Ballenthin
72e836166f
proto: better convert to/from proto
2023-09-05 10:24:53 +00:00
Willi Ballenthin
d64ab41dfd
tests: proto: add more dynamic proto tests
2023-09-05 10:23:55 +00:00
Willi Ballenthin
2a757b0cbb
submodule: test data: update
2023-09-05 10:22:59 +00:00
Willi Ballenthin
69836a0f13
proto: add dynamic test
2023-09-05 10:22:33 +00:00
Willi Ballenthin
3725618d50
render: proto: use Static/Dynamic analysis types
2023-09-05 08:37:11 +00:00
Willi Ballenthin
766b05e5c3
Merge branch 'dynamic-feature-extraction' into fix/dynamic-proto
2023-09-05 08:18:51 +00:00
Aayush Goel
6317153ef0
Update tests/test_rules.py
...
Co-authored-by: Moritz <mr-tz@users.noreply.github.com >
2023-08-30 21:48:55 +05:30
Yacine Elhamer
73c158ad68
point submodules towards the right branch
2023-08-30 11:42:43 +02:00
Aayush Goel
ab3747e448
added com prefix CLSID, IID
2023-08-30 01:00:07 +05:30
Yacine Elhamer
49adecb25c
add yaml representer for the Scope class, as well as other bugfixes
2023-08-26 18:11:35 +02:00
Yacine Elhamer
e9a9b3a6b6
point the data file to the latest PR
2023-08-26 13:04:45 +02:00
Mike Hunhoff
65179805a7
add a Ghidra entry script users can invoke to run capa against a loaded Ghidra database ( #1767 )
...
* enable use of Ghidra with show-features.py
* fix bug in is_supported_file_type
* fix bug in GhidraFeatureExtractor.get_function
* refactor get_insn_in_range
* add Ghidra entry script for users to more easily run capa against a loaded Ghidra database
* update CHANGELOG
* fixing lint
* fix fixtures import issue
* fix bug in is_supported_arch_type
* add check for supported arch type
* fix extract_embedded_pe performance
2023-08-25 18:35:59 -07:00
Aayush Goel
90df85b332
test for com_feature
...
matching a file as expected
generating the bytes/strings
if an unknown COM class/interface is provided?
2023-08-25 20:59:58 +05:30
Willi Ballenthin
f96b9e6a6e
proto: add RuleMetadata.scopes
2023-08-25 13:20:46 +00:00
Willi Ballenthin
e4c1361d42
Merge branch 'fix/scope-enum-usage' into fix/dynamic-proto
2023-08-25 13:01:49 +00:00
Willi Ballenthin
a734358377
rules: use Scope enum instead of constants
2023-08-25 12:54:57 +00:00
Willi Ballenthin
f2909c82f3
proto: reenable tests and linters
2023-08-25 09:41:25 +00:00
Yacine Elhamer
f34b0355e7
test_result_document.py: re-enable result-document related tests
2023-08-25 10:56:12 +02:00
Yacine
d66f834e54
Update tests/test_scripts.py
...
Co-authored-by: Moritz <mr-tz@users.noreply.github.com >
2023-08-24 13:48:32 +02:00
Yacine Elhamer
3574bd49bd
Merge remote-tracking branch 'parentrepo/dynamic-feature-extraction' into fix-cape2fmt
2023-08-24 14:48:07 +02:00
Yacine Elhamer
46217a3acb
test_main.py: remove unused pytest
2023-08-24 14:47:40 +02:00
Yacine Elhamer
9eb1255b29
cape2yara.py: update for use of scopes, and fix bug
2023-08-24 14:32:49 +02:00
Yacine Elhamer
7c101f01e5
test_binja.py: revert ruleset-related xfails
2023-08-24 13:36:53 +02:00
Yacine Elhamer
42689ef1da
test_main.py: revert ruleset-related xfails
2023-08-24 13:30:22 +02:00
Colton Gabertan
19b8000c00
Ghidra: Fixes & Enhancements ( #1733 )
...
* restore from corrupted .git
* lint repo
* temp: remove lint failing rule
* implement dereferencing, clean up extractors
* implement proper dereferencing routines as applicable
* fix nzxor implementation, remediate ghidra analysis issues
* lint repo
* Assert typing, lint repo
* avoid extracting pointers in bytes extraction
* attempt to recover submodule
* implement GhidraFeatureExtractor & ghidra_main()
* lint repo
* document examples, clean-up & testing
* lint repo
* properly map import dict
* properly map fake addresses
* fix fake addr mapping
* properly map externs
* re-align consistency with other backends
* lint repo
* fix dereferencing routine
* clean up helpers
* fix format string
* disable progress bar to exit gracefully
* enable pbar in headless runtime mode
* implement fixture test script
* implement ghidra unit test script
* refactor repo for breaking Ghidrathon change
* bump ghidrathon CI version, run unit test in CI
* change CI config
* fix wget line for ghidrathon
* fix unzip paths
* fix ghidra import issue
* disable pytest faulthandler module
* fix dereference function
* fix ghidra state variables
* implement dereferencing for string extraction
* use toAddr
* restructure for consistency
* Bump Ghidrathon version for CI, fix pytest ghidra runtime detection
* fix number & offset extractors
* yield both signed & unsgned values for offset extraction
* add LEA insn handling to number & offset extraction
* fix indirect call extraction
* implement thunk function checking for dereferences
* revise ghidra feature count tests, pass unit testing
* fix feature test format
* implement additional support for dereferencing thunked functions
* integrate external locations into find_file_imports
* change api yield string for .elf samples to match other extractors
* fix potential NoneType errors during dereferencing
* user helper in global_
* fix GHIDRAIO class, implement in global_
* comment on getOriginalByte
* simplify get_file_imports
* implement explicit thunk chain handling
* simplify LEA number extraction
* simplify thunk handling
* temp: demonstrate CI failure & output
* fix log path
* run new test against mimikatz
2023-08-23 14:35:18 -06:00
Yacine Elhamer
d1068991e3
test_rules_insn_scope.py: update rules missing the dynamic scope
2023-08-22 16:26:54 +02:00
Willi Ballenthin
4ab240e990
rules: add scope terms "unsupported" and "unspecified"
...
closes #1744
2023-08-22 12:58:06 +00:00
Colton Gabertan
058c1fefd2
ghidra: unit tests ( #1727 )
...
* restore from corrupted .git
* lint repo
* temp: remove lint failing rule
* implement dereferencing, clean up extractors
* implement proper dereferencing routines as applicable
* fix nzxor implementation, remediate ghidra analysis issues
* lint repo
* Assert typing, lint repo
* avoid extracting pointers in bytes extraction
* attempt to recover submodule
* implement GhidraFeatureExtractor & ghidra_main()
* lint repo
* document examples, clean-up & testing
* lint repo
* properly map import dict
* properly map fake addresses
* fix fake addr mapping
* properly map externs
* re-align consistency with other backends
* lint repo
* fix dereferencing routine
* clean up helpers
* fix format string
* disable progress bar to exit gracefully
* enable pbar in headless runtime mode
* implement fixture test script
* implement ghidra unit test script
* refactor repo for breaking Ghidrathon change
* bump ghidrathon CI version, run unit test in CI
* change CI config
* fix wget line for ghidrathon
* fix unzip paths
* fix ghidra import issue
* disable pytest faulthandler module
* fix ghidra state variables
* use toAddr
* restructure for consistency
* Bump Ghidrathon version for CI, fix pytest ghidra runtime detection
2023-08-21 12:16:13 -06:00
