 Yacine
|
23bd2e7cd4
|
cape/call.py: remove use of the description keyword for features
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
|
2023-08-07 09:13:07 +01:00 |
|
|
Yacine Elhamer
|
f461f65a86
|
move thread-scope features into the call-scope
|
2023-08-06 18:12:29 +01:00 |
|
|
Yacine Elhamer
|
8dc4adbb5e
|
fix test_rules.py yaml identation bug
|
2023-08-04 16:20:37 +01:00 |
|
|
Yacine Elhamer
|
8b36cd1e35
|
add call-scope tests
|
2023-08-04 16:20:37 +01:00 |
|
|
Yacine
|
cd700a1782
|
Merge branch 'dynamic-feature-extraction' into call-scope
|
2023-08-03 15:27:44 +01:00 |
|
|
Yacine
|
60e94adeb1
|
base_extractor.py: fix ProcessHandle documentation comment
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
|
2023-08-03 14:39:53 +01:00 |
|
|
Yacine
|
eafed0f1d4
|
build_statements(): fix call-scope InvalidRule message typo
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
|
2023-08-03 14:38:38 +01:00 |
|
|
Yacine Elhamer
|
7c14c51012
|
cape/call.py: update extract_call_features() comment
|
2023-08-03 14:20:18 +01:00 |
|
|
Yacine Elhamer
|
4f9d24598f
|
bugfix
|
2023-08-03 11:24:24 +01:00 |
|
|
Yacine Elhamer
|
4277b4bef8
|
include an address' parent in comparisons
|
2023-08-03 11:21:58 +01:00 |
|
|
Yacine Elhamer
|
3c3205adf1
|
add call address to show-features.py script
|
2023-08-02 23:10:27 +01:00 |
|
|
Yacine Elhamer
|
4e1527df95
|
update changelog
|
2023-08-02 22:48:38 +01:00 |
|
|
Yacine Elhamer
|
ca2760fb46
|
Initial commit
|
2023-08-02 22:46:54 +01:00 |
|
|
Willi Ballenthin
|
61924672e2
|
Merge pull request #1671 from yelhamer/rule-statement-building
|
2023-08-01 22:15:03 +02:00 |
|
|
Yacine Elhamer
|
7fdd988e4f
|
remove redundant imports
|
2023-08-01 20:12:15 +01:00 |
|
|
Yacine Elhamer
|
a85e0523f8
|
remove Scopes LRU caching
|
2023-08-01 20:09:42 +01:00 |
|
|
Yacine Elhamer
|
462024ad03
|
update tests to explicitely specify scopes
|
2023-08-01 07:41:47 +01:00 |
|
|
Yacine Elhamer
|
f0d09899a1
|
rules/__init__.py: invalidate rules with no scopes field
|
2023-08-01 07:19:11 +01:00 |
|
|
Yacine Elhamer
|
b8212b3da7
|
main.py: replace | operator with Optional
|
2023-07-27 16:00:52 +01:00 |
|
|
Yacine Elhamer
|
3d812edc4d
|
use weakrefs for Scopes instantiation; fix test_rules()
|
2023-07-27 15:52:39 +01:00 |
|
|
Yacine Elhamer
|
2efb7f2975
|
fix flake8 issues
|
2023-07-27 15:10:01 +01:00 |
|
|
Yacine Elhamer
|
44c5e96cf0
|
RuleSet: remove irrelevant rules after dependecies have been checked
|
2023-07-27 12:44:07 +01:00 |
|
|
Yacine Elhamer
|
97c878db22
|
update CHANGELOG
|
2023-07-27 10:33:34 +01:00 |
|
|
Yacine Elhamer
|
16e32f8441
|
add tests
|
2023-07-27 10:31:45 +01:00 |
|
|
Yacine Elhamer
|
d6aced5ec7
|
RulSet: add flavor-based rule filtering
|
2023-07-27 10:24:08 +01:00 |
|
|
Yacine Elhamer
|
b843382065
|
rules/__init__.py: update Scopes class
|
2023-07-26 17:20:51 +01:00 |
|
|
Willi Ballenthin
|
f4bdff0824
|
Merge pull request #1644 from yelhamer/find-dynamic-capabilities
|
2023-07-21 20:08:22 +02:00 |
|
|
Yacine Elhamer
|
d8c28e80eb
|
add get_sample_hashes() to elf extractor
|
2023-07-21 15:50:09 +01:00 |
|
|
yelhamer
|
344b3e9931
|
Update capa/features/extractors/base_extractor.py
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
|
2023-07-21 15:43:56 +01:00 |
|
|
yelhamer
|
c32ac19c0d
|
Update capa/features/extractors/ida/extractor.py
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
|
2023-07-21 15:43:41 +01:00 |
|
|
yelhamer
|
d13114e907
|
remove SampleHashes __iter__method
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
|
2023-07-21 15:43:22 +01:00 |
|
|
yelhamer
|
90298fe2c8
|
Update capa/features/extractors/base_extractor.py
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
|
2023-07-21 15:39:30 +01:00 |
|
|
Yacine Elhamer
|
3d1a1fb9fa
|
add get_sample_hashes() to NullFeatureExtractor
|
2023-07-21 14:54:54 +01:00 |
|
|
Yacine Elhamer
|
830bad54bd
|
fix bugs
|
2023-07-21 14:41:07 +01:00 |
|
|
Yacine Elhamer
|
c4ba5afe6b
|
replace : FeatureSet annotations with a comment type annotation
|
2023-07-21 14:32:42 +01:00 |
|
|
Yacine Elhamer
|
4ec39d49aa
|
fix linting issues
|
2023-07-21 14:03:57 +01:00 |
|
|
Yacine Elhamer
|
ab585ef951
|
add the skipif mark back
|
2023-07-21 14:00:58 +01:00 |
|
|
Yacine Elhamer
|
674122999f
|
migrate the get_sample_hashes() function to each individual extractor
|
2023-07-21 14:00:01 +01:00 |
|
|
Yacine Elhamer
|
8085caef35
|
remove the usage of SampleHashes's __iter__() method
|
2023-07-21 13:48:48 +01:00 |
|
|
Yacine Elhamer
|
3ab3c61d5e
|
use ida's hash-extraction functions
|
2023-07-21 13:48:48 +01:00 |
|
|
Yacine Elhamer
|
736b2cd689
|
address @mr-tz main.py review comments
|
2023-07-21 13:48:48 +01:00 |
|
|
yelhamer
|
bd8331678c
|
update compute_static_layout with the appropriate types
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
|
2023-07-21 13:16:51 +01:00 |
|
|
yelhamer
|
6f3fb42385
|
update compute_dynamic_layout with the appropriate type
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
|
2023-07-21 13:15:55 +01:00 |
|
|
yelhamer
|
da4e887aee
|
fix comment typo
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
|
2023-07-21 12:40:02 +01:00 |
|
|
Yacine Elhamer
|
b1e468dae4
|
add tests for the get_sample_hashes() method
|
2023-07-21 11:04:21 +01:00 |
|
|
Yacine Elhamer
|
6d1a885864
|
update static freeze test
|
2023-07-21 08:48:18 +01:00 |
|
|
Yacine Elhamer
|
24b3abd706
|
add get_sample_hashes() to base extractor
|
2023-07-21 08:45:14 +01:00 |
|
|
yelhamer
|
806bc1853d
|
Update mypy.ini: add TODO comment
|
2023-07-20 22:13:06 +01:00 |
|
|
Yacine Elhamer
|
6ee1dfd656
|
address review comments: rename SampleHashes's from_sample() method to from_bytes() method
|
2023-07-20 21:53:28 +01:00 |
|
|
Yacine Elhamer
|
ab092cb536
|
add sample_hashes attribute to the base extractors
|
2023-07-20 21:51:37 +01:00 |
|