970977ade5
tests: demonstrate a bit more depth to namespace matching
2020-06-30 00:20:40 -06:00
e2296f0f40
Merge branch 'master' of github.com:fireeye/capa into match-namespaces
2020-06-30 00:18:44 -06:00
5cbfbc4997
Merge pull request #34 from fireeye/rule-organization
...
update output rendering
2020-06-29 13:07:51 -06:00
3f4489849a
Merge branch 'master' of github.com:fireeye/capa
2020-06-29 12:28:30 -06:00
d97e4fb1d8
Merge pull request #54 from fireeye/py3-changes-for-capa-json
...
Python 3 serialization changes
2020-06-30 22:07:34 -06:00
52f7fb561f
changes to support py3
2020-06-30 16:45:08 -06:00
7d644fd86b
Merge pull request #38 from fireeye/ana-fix-keyerror
...
Fix KeyError when deleting nonexistent keys
2020-06-30 15:21:12 -06:00
59beee6b4a
Merge pull request #44 from fireeye/doclint/unsigned
...
Doclint/unsigned
2020-06-30 15:19:45 -06:00
5cee0d9b80
add lint negative numbers and cleanup tests
2020-06-30 22:17:42 +02:00
afe5dba92a
document signed vs unsigned
2020-06-30 22:11:57 +02:00
8e78d8de53
Fix KeyError when deleting nonexistent keys
...
`hidden_meta` saves not only the existing hidden meta keys, but also
those who don't exist with value `None`. For example:
```
{'capa/path': None, 'capa/nursery': None}
```
Deleting nonexistent keys raises a `KeyError` exception.
2020-06-30 14:24:06 +02:00
51fec3959c
render: fix exception when lib rule has no namespace
2020-06-29 12:28:18 -06:00
fbbc8a573f
main: remove old render code
2020-06-29 12:28:01 -06:00
b1374f2dd0
submodule: rules: update
2020-06-29 12:26:31 -06:00
c5a718d5ba
main: emit json even if there are file limitations
...
closes #53
2020-06-29 12:06:31 -06:00
325aa9574f
linter: check that lib rules don't have a namespace
...
closes #35
2020-06-29 06:16:19 -06:00
6e08cabea1
submodule: rules: update
2020-06-29 06:15:47 -06:00
7a5d2d025f
linter: check that lib rules are in lib directory
...
closes #36
2020-06-29 06:09:18 -06:00
9d297e6699
linter: ignore testbed files
2020-06-29 06:09:02 -06:00
990c2010e9
pep8
2020-06-29 05:57:46 -06:00
3d0bd64e1b
engine, rules: support matching namespaces, not just rule names
...
closes #37
2020-06-29 05:54:56 -06:00
0a5947290b
main: add --version flag
...
closes ghe#402
2020-06-28 13:10:17 -06:00
39a49fb4b9
submodule: rules: bump to master
2020-06-28 13:01:56 -06:00
96158c6ca5
main: update detection for unsupported files via namespace matches
2020-06-28 12:58:34 -06:00
3b8f686243
readme: update example and describe namespace, removing rule-category
2020-06-28 12:52:45 -06:00
ed12c4758b
render: group ATT&CK tags in a single table
2020-06-28 12:23:07 -06:00
a12bcf238b
pep8
2020-06-28 12:13:31 -06:00
112ddb43c9
render: hint min width of tables
2020-06-28 12:13:17 -06:00
c9ab5f9dda
render: fix handling of file-scope rules
2020-06-28 12:05:15 -06:00
7c51fd4890
render: fix rendering of file scope results
2020-06-28 12:04:53 -06:00
f77e1f4946
render: include rule source in the json
2020-06-28 11:55:33 -06:00
c34578b80c
render: hint number of matches in verbose and vverbose mode
2020-06-28 11:52:03 -06:00
ef4be10543
render: show logic under not nodes
2020-06-28 11:48:23 -06:00
5f598e8a08
render: learn to render Range/Count statements
2020-06-28 11:30:23 -06:00
cb8fedc1b9
engine: Range should never return children results
2020-06-28 11:29:36 -06:00
a355f2f0c6
render: hint the number of matches
2020-06-28 10:33:28 -06:00
c55ce3c1f0
render: hint number of hidden locations
2020-06-28 09:55:08 -06:00
1d00f188f1
render: format numbers and offsets as hex
2020-06-28 09:53:14 -06:00
d04c9db399
render: ellipsis formatting
2020-06-28 09:39:52 -06:00
617b55ae3c
render: only show 4 locations before using an ellipsis
2020-06-28 09:37:48 -06:00
71177c9d77
pep8
2020-06-28 09:32:16 -06:00
4c4b538a6a
render: emit bytes uppercase, separated
2020-06-28 09:31:15 -06:00
9be448a900
render: dont display implied True for characteristic
2020-06-28 09:20:34 -06:00
bdc635a0f9
render: capture and display matched regex string
2020-06-28 09:20:25 -06:00
50dc945103
render: dont forget about bytes feature
2020-06-28 08:54:46 -06:00
cad438a9bd
render: remove dead code
2020-06-28 08:53:41 -06:00
e3245385c1
linter: use posixpath to normalize slashes
2020-06-28 08:52:30 -06:00
eca87ab976
render: verbose: only show some meta keys
2020-06-28 08:50:05 -06:00
67c511e085
render: display lists of things as comma separated
2020-06-28 08:47:50 -06:00
9f2c4248e5
render: display addresses as upper case hex
2020-06-28 08:44:32 -06:00
William Ballenthin