gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2026-07-28 22:50:59 -07:00
Code Issues Packages Projects Releases Wiki Activity
5,037 Commits 53 Branches 49 Tags
webui
Commit Graph
5037 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Maxime BerthaultandGitHub 76913af20b Binary Ninja update and fix (#2205) 
* Fix binja warning (use of a deprecated API method)

* Update binja plugin
> Fix json openning and parsing
> Fix base address

* Fix code_style

* lint black update
 2024-07-12 12:25:19 +02:00
MoritzandGitHub bb86d1485c Merge pull request #2187 from mandiant/dependabot/pip/flake8-comprehensions-3.15.0 
build(deps): bump flake8-comprehensions from 3.14.0 to 3.15.0
 2024-07-02 11:14:26 +02:00
MoritzandGitHub cd3086cfa4 Merge pull request #2184 from mandiant/dependabot/pip/ruff-0.5.0 
build(deps): bump ruff from 0.4.8 to 0.5.0
 2024-07-02 11:14:11 +02:00
Capa Bot 120f34e8ef Sync capa-testfiles submodule 2024-07-02 07:56:15 +00:00
Ilyas OsmanandGitHub 5495a8555c Fix incomplete f-strings (#2188) 
* Fix incomplete f-strings

* Fix incomplete f-strings

* Apply black formatting to fix linting errors

* Apply black formatting to fix linting errors
 2024-07-02 09:53:41 +02:00
MoritzandGitHub 1a447013bd Merge pull request #2182 from yelhamer/process-name-interface-show-features 
scripts/show-features.py: use extractor.get_process_name() interface …
 2024-07-02 09:48:17 +02:00
Yacine Elhamer fccb533841 test/scripts.py: bugfix 2024-07-01 21:59:28 +01:00
Yacine Elhamer 3b165c3d8e test:scripts.py: add tests for show-features.py process filtering 2024-07-01 21:41:46 +01:00
dependabot[bot]andGitHub cd5199f873 build(deps): bump flake8-comprehensions from 3.14.0 to 3.15.0 
Bumps [flake8-comprehensions](https://github.com/adamchainz/flake8-comprehensions) from 3.14.0 to 3.15.0.
- [Changelog](https://github.com/adamchainz/flake8-comprehensions/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/adamchainz/flake8-comprehensions/compare/3.14.0...3.15.0)

---
updated-dependencies:
- dependency-name: flake8-comprehensions
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-07-01 14:48:28 +00:00
dependabot[bot]andGitHub 202b5ddae7 build(deps): bump ruff from 0.4.8 to 0.5.0 
Bumps [ruff](https://github.com/astral-sh/ruff) from 0.4.8 to 0.5.0.
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](https://github.com/astral-sh/ruff/compare/v0.4.8...0.5.0)

---
updated-dependencies:
- dependency-name: ruff
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-07-01 14:48:15 +00:00
Yacine Elhamer 0b70abca93 show-features.py: add other usage of get_process_name() 2024-07-01 12:03:12 +01:00
Yacine Elhamer 6de22a0264 show-features.py: fix process filtering bug 2024-07-01 10:34:19 +01:00
Yacine Elhamer fd811d1387 scripts/show-features.py: use extractor.get_process_name() interface for getting process name 2024-07-01 09:55:24 +01:00
MoritzandGitHub b617179525 Merge pull request #2165 from mandiant/dependabot/pip/flake8-7.1.0 
build(deps): bump flake8 from 7.0.0 to 7.1.0
 2024-06-26 17:07:49 +02:00
MoritzandGitHub 28fc671ad5 Merge pull request #2166 from mandiant/dependabot/pip/requests-2.32.3 
build(deps): bump requests from 2.31.0 to 2.32.3
 2024-06-26 17:07:28 +02:00
MoritzandGitHub e1b750f1e9 Merge pull request #2167 from mandiant/dependabot/pip/psutil-6.0.0 
build(deps): bump psutil from 5.9.2 to 6.0.0
 2024-06-26 17:07:05 +02:00
dependabot[bot]andGitHub 1ec680856d build(deps): bump requests from 2.31.0 to 2.32.3 
Bumps [requests](https://github.com/psf/requests) from 2.31.0 to 2.32.3.
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](https://github.com/psf/requests/compare/v2.31.0...v2.32.3)

---
updated-dependencies:
- dependency-name: requests
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-06-26 14:24:17 +00:00
dependabot[bot]andGitHub d79ea074f2 build(deps): bump flake8 from 7.0.0 to 7.1.0 
Bumps [flake8](https://github.com/pycqa/flake8) from 7.0.0 to 7.1.0.
- [Commits](https://github.com/pycqa/flake8/compare/7.0.0...7.1.0)

---
updated-dependencies:
- dependency-name: flake8
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-06-26 14:23:05 +00:00
dependabot[bot]andGitHub e68bcddfe0 build(deps): bump psutil from 5.9.2 to 6.0.0 
Bumps [psutil](https://github.com/giampaolo/psutil) from 5.9.2 to 6.0.0.
- [Changelog](https://github.com/giampaolo/psutil/blob/master/HISTORY.rst)
- [Commits](https://github.com/giampaolo/psutil/compare/release-5.9.2...release-6.0.0)

---
updated-dependencies:
- dependency-name: psutil
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-06-26 14:05:14 +00:00
MoritzandGitHub 4929d5936e Update macos 12 (#2174) 
* update CI to use macos-12 instead of macos-11
 2024-06-26 16:03:45 +02:00
ygasparisandGitHub 1975b6455c extract import / export symbols from stripped elf binaries (#2142) 2024-06-18 12:38:02 -06:00
Capa Bot 1360e08389 Sync capa-testfiles submodule 2024-06-18 11:00:26 +00:00
dependabot[bot]andGitHub 40061b3c42 build(deps): bump viv-utils from 0.7.9 to 0.7.11 (#2150) 2024-06-18 06:36:10 +02:00
dependabot[bot]andGitHub 45fca7adea build(deps): bump python-flirt from 0.8.6 to 0.8.10 (#2151) 2024-06-18 06:35:50 +02:00
MoritzandGitHub 482686ab81 Merge pull request #2147 from mandiant/release/v710 
bump to v7.1.0
v7.1.0 		2024-06-14 12:56:46 +02:00
mr-tz 67f8c4d28c bump to v7.1.0 2024-06-14 09:06:04 +00:00
Capa Bot 3f151a342b Sync capa rules submodule 2024-06-14 09:02:02 +00:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Willi Ballenthin
 		e87e8484b6 build(deps): bump ruff from 0.4.7 to 0.4.8 (#2139) 
Bumps [ruff](https://github.com/astral-sh/ruff) from 0.4.7 to 0.4.8.
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](https://github.com/astral-sh/ruff/compare/v0.4.7...v0.4.8)

---
updated-dependencies:
- dependency-name: ruff
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Willi Ballenthin <wballenthin@google.com>
 2024-06-13 13:24:33 +02:00
Willi BallenthinandGitHub 8726de0d65 ELF: Detect OS from Go binaries (#1987) 
* elf: read segment memory size

* elf: add routine to read mapped memory

* elf: better detect OS for binaries compiled by Go

* elf: guess OS from Go source filenames

* changelog

* elf: mypy

* merge

* elf: add OS detection based on vDSO strings

* elf: document VTGrep searches

* elf: describe further technique to identify Go binaries

* elf: search for `.go.buildinfo` section via @yelhamer

* black

* elf: detect Alpine Linux ident

* elf: log interest symtab entries

* tests: add test for OS detection by Go buildinfo

* loader: handle missing viv modules

* pre-commit: run deptry before tests (which are slow)

* loader: describe removing viv symbolic switch solver

* pyproject: add PyGithub for deptry

* black
 2024-06-13 13:23:47 +02:00
MoritzandGitHub 7d1512a3de Merge pull request #2146 from mandiant/fix/2145 
fix black and mypy
 2024-06-13 11:49:18 +02:00
Capa Bot 73d76d7aba Sync capa-testfiles submodule 2024-06-13 09:30:44 +00:00
mr-tz 1febb224d1 add scripts dependency group 2024-06-13 07:50:58 +00:00
MoritzGitHubWilli Ballenthin
 		e3ea60d354 Apply suggestions from code review 
Co-authored-by: Willi Ballenthin <wballenthin@google.com>
 2024-06-13 09:36:12 +02:00
mr-tz 93cd1dcedd add scripts to install step 2024-06-12 15:24:10 +00:00
mr-tz 7b0270980d add capa2sarif dependencies 2024-06-12 15:19:24 +00:00
mr-tz cce7774705 add scripts section 2024-06-12 15:17:31 +00:00
mr-tz 9ec9a6f439 fix mypy issues 2024-06-12 09:32:03 +00:00
mr-tz 97a3fba2c9 fix black 2024-06-12 09:24:16 +00:00
Capa Bot 893352756f Sync capa rules submodule 2024-06-11 18:11:24 +00:00
malwarefrankGitHubMoritzmr-tz
 		0cc06aa83d dnfile 0.15.0 changed API (#2037) 
* dnfile 0.15.0 changed API

* deduplicate str() calls and isort fixes

* revert accidental change to imports ordering

* add table variable annotation

---------

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
Co-authored-by: mr-tz <moritz.raabe@mandiant.com>
 2024-06-11 11:46:09 -06:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		1888d0e7e3 build(deps): bump setuptools from 69.5.1 to 70.0.0 (#2135) 
Bumps [setuptools](https://github.com/pypa/setuptools) from 69.5.1 to 70.0.0.
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](https://github.com/pypa/setuptools/compare/v69.5.1...v70.0.0)

---
updated-dependencies:
- dependency-name: setuptools
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-06-11 15:03:56 +02:00
ReWithMeGitHubReversingWithMeWilli Ballenthin
 		52e24e560b FEAT(capa2sarif) Add SARIF conversion script from json output (#2093) 
* feat(capa2sarif): add new sarif conversion script converting json output to sarif schema, update dependencies, and update changelog

* fix(capa2sarif): removing copy and paste transcription errors

* fix(capa2sarif): remove dependencies from pyproject toml to guarded import statements

* chore(capa2sarif): adding node in readme specifying dependency and applied auto formatter for styling

* style(capa2sarif): applied import sorting and fixed typo in invocations function

* test(capa2sarif): adding simple test for capa to sarif conversion script using existing result document

* style(capa2sarif): fixing typo in version string in usage

* style(capa2sarif): isort failing due to reordering of typehint imports

* style(capa2sarif): fixing import order as isort on local machine was not updating code

---------

Co-authored-by: ReversingWithMe <ryanv@rewith.me>
Co-authored-by: Willi Ballenthin <wballenthin@google.com>
 2024-06-11 15:01:26 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		c97d2d7244 build(deps): bump pyinstaller from 6.7.0 to 6.8.0 (#2138) 
Bumps [pyinstaller](https://github.com/pyinstaller/pyinstaller) from 6.7.0 to 6.8.0.
- [Release notes](https://github.com/pyinstaller/pyinstaller/releases)
- [Changelog](https://github.com/pyinstaller/pyinstaller/blob/develop/doc/CHANGES.rst)
- [Commits](https://github.com/pyinstaller/pyinstaller/compare/v6.7.0...v6.8.0)

---
updated-dependencies:
- dependency-name: pyinstaller
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-06-11 14:36:58 +02:00
Willi BallenthinGitHubMoritz
 		833ec47170 relax pyproject dependency versions and introduce requirements.txt (#2132) 
* relax pyproject dependency versions and introduce requirements.txt

closes #2053
closes #2079

* pyproject: document dev/build profile dependency policies

* changelog

* doc: installation: describe requirements.txt usage

* pyproject: don't use dnfile 0.15 yet

---------

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
 2024-06-11 14:29:34 +02:00
Willi BallenthinandGitHub 07ae30875c features: add aarch64 arch (#2144) 
* features: add aarch64 arch
 2024-06-11 09:36:04 +02:00
Willi BallenthinandWilli Ballenthin 76a4a5899f test_scripts: avoid unsupported logic combinations 2024-06-07 05:54:49 +02:00
Willi BallenthinandWilli Ballenthin 4d81b7ab98 rules: add references to existing issues 2024-06-07 05:54:49 +02:00
Willi BallenthinandWilli Ballenthin b068890fa6 rules: match: optimize rule matching by better indexing rule by features 
Implement the "tighten rule pre-selection" algorithm described here:
https://github.com/mandiant/capa/issues/2063#issuecomment-2100498720

In summary:

> Rather than indexing all features from all rules,
> we should pick and index the minimal set (ideally, one) of
> features from each rule that must be present for the rule to match.
> When we have multiple candidates, pick the feature that is
> probably most uncommon and therefore "selective".

This seems to work pretty well. Total evaluations when running against
mimikatz drop from 19M to 1.1M (wow!) and capa seems to match around
3x more functions per second (wow wow).

When doing large scale runs, capa is about 25% faster when using the
vivisect backend (analysis heavy) or 3x faster when using the
upcoming BinExport2 backend (minimal analysis).
 2024-06-07 05:54:49 +02:00
dependabot[bot]andWilli Ballenthin d10d2820b2 build(deps): bump types-requests from 2.32.0.20240523 to 2.32.0.20240602 
Bumps [types-requests](https://github.com/python/typeshed) from 2.32.0.20240523 to 2.32.0.20240602.
- [Commits](https://github.com/python/typeshed/commits)

---
updated-dependencies:
- dependency-name: types-requests
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-06-06 10:43:08 +02:00
Capa Bot 5239e40beb Sync capa-testfiles submodule 2024-06-05 12:15:41 +00:00