Aayush Goel
412d296d6b
Merge branch 'mandiant:master' into Aayush-Goel-04/Issue#322
2023-10-16 16:38:18 +05:30
Aayush Goel
db32d90480
tests updated
2023-10-16 16:35:30 +05:30
Capa Bot
40ba6679f0
Sync capa-testfiles submodule
2023-10-11 14:36:05 +00:00
Moritz
a9daa92c9a
Merge branch 'master' into Aayush-Goel-04/Issue#322
2023-10-09 18:22:46 +02:00
Willi Ballenthin
8a019aa360
Merge branch 'master' into test_binja_forwarded_export
2023-09-27 08:48:21 +02:00
Capa Bot
79cef0e783
Sync capa-testfiles submodule
2023-09-22 10:33:01 +00:00
Willi Ballenthin
09b54a86f0
Merge branch 'master' into test_binja_forwarded_export
2023-09-21 12:10:13 +02:00
Xusheng
55af6f052f
binja: add support for symtab names. Fix #1504
2023-09-21 17:24:42 +08:00
Xusheng
d2d32f88ef
binja: add support for forwarded exports
2023-09-21 15:32:55 +08:00
Xusheng
bc71c94171
binja: use binaryninja.load to open a binary
2023-09-21 09:51:01 +08:00
Xusheng
59d03b3ba3
binja: bump Binary Ninja version to 3.5
2023-09-20 21:00:04 +08:00
Capa Bot
d04ae5294e
Sync capa-testfiles submodule
2023-09-13 14:50:29 +00:00
Aayush Goel
8331ed6ea0
Merge branch 'mandiant:master' into Aayush-Goel-04/Issue#322
2023-09-06 16:35:29 +05:30
Aayush Goel
6317153ef0
Update tests/test_rules.py
...
Co-authored-by: Moritz <mr-tz@users.noreply.github.com >
2023-08-30 21:48:55 +05:30
Aayush Goel
ab3747e448
added com prefix CLSID, IID
2023-08-30 01:00:07 +05:30
Mike Hunhoff
65179805a7
add a Ghidra entry script users can invoke to run capa against a loaded Ghidra database ( #1767 )
...
* enable use of Ghidra with show-features.py
* fix bug in is_supported_file_type
* fix bug in GhidraFeatureExtractor.get_function
* refactor get_insn_in_range
* add Ghidra entry script for users to more easily run capa against a loaded Ghidra database
* update CHANGELOG
* fixing lint
* fix fixtures import issue
* fix bug in is_supported_arch_type
* add check for supported arch type
* fix extract_embedded_pe performance
2023-08-25 18:35:59 -07:00
Aayush Goel
90df85b332
test for com_feature
...
matching a file as expected
generating the bytes/strings
if an unknown COM class/interface is provided?
2023-08-25 20:59:58 +05:30
Colton Gabertan
19b8000c00
Ghidra: Fixes & Enhancements ( #1733 )
...
* restore from corrupted .git
* lint repo
* temp: remove lint failing rule
* implement dereferencing, clean up extractors
* implement proper dereferencing routines as applicable
* fix nzxor implementation, remediate ghidra analysis issues
* lint repo
* Assert typing, lint repo
* avoid extracting pointers in bytes extraction
* attempt to recover submodule
* implement GhidraFeatureExtractor & ghidra_main()
* lint repo
* document examples, clean-up & testing
* lint repo
* properly map import dict
* properly map fake addresses
* fix fake addr mapping
* properly map externs
* re-align consistency with other backends
* lint repo
* fix dereferencing routine
* clean up helpers
* fix format string
* disable progress bar to exit gracefully
* enable pbar in headless runtime mode
* implement fixture test script
* implement ghidra unit test script
* refactor repo for breaking Ghidrathon change
* bump ghidrathon CI version, run unit test in CI
* change CI config
* fix wget line for ghidrathon
* fix unzip paths
* fix ghidra import issue
* disable pytest faulthandler module
* fix dereference function
* fix ghidra state variables
* implement dereferencing for string extraction
* use toAddr
* restructure for consistency
* Bump Ghidrathon version for CI, fix pytest ghidra runtime detection
* fix number & offset extractors
* yield both signed & unsgned values for offset extraction
* add LEA insn handling to number & offset extraction
* fix indirect call extraction
* implement thunk function checking for dereferences
* revise ghidra feature count tests, pass unit testing
* fix feature test format
* implement additional support for dereferencing thunked functions
* integrate external locations into find_file_imports
* change api yield string for .elf samples to match other extractors
* fix potential NoneType errors during dereferencing
* user helper in global_
* fix GHIDRAIO class, implement in global_
* comment on getOriginalByte
* simplify get_file_imports
* implement explicit thunk chain handling
* simplify LEA number extraction
* simplify thunk handling
* temp: demonstrate CI failure & output
* fix log path
* run new test against mimikatz
2023-08-23 14:35:18 -06:00
Colton Gabertan
058c1fefd2
ghidra: unit tests ( #1727 )
...
* restore from corrupted .git
* lint repo
* temp: remove lint failing rule
* implement dereferencing, clean up extractors
* implement proper dereferencing routines as applicable
* fix nzxor implementation, remediate ghidra analysis issues
* lint repo
* Assert typing, lint repo
* avoid extracting pointers in bytes extraction
* attempt to recover submodule
* implement GhidraFeatureExtractor & ghidra_main()
* lint repo
* document examples, clean-up & testing
* lint repo
* properly map import dict
* properly map fake addresses
* fix fake addr mapping
* properly map externs
* re-align consistency with other backends
* lint repo
* fix dereferencing routine
* clean up helpers
* fix format string
* disable progress bar to exit gracefully
* enable pbar in headless runtime mode
* implement fixture test script
* implement ghidra unit test script
* refactor repo for breaking Ghidrathon change
* bump ghidrathon CI version, run unit test in CI
* change CI config
* fix wget line for ghidrathon
* fix unzip paths
* fix ghidra import issue
* disable pytest faulthandler module
* fix ghidra state variables
* use toAddr
* restructure for consistency
* Bump Ghidrathon version for CI, fix pytest ghidra runtime detection
2023-08-21 12:16:13 -06:00
Yacine
d71ecc7a79
Update tests/test_ida_features.py
...
Co-authored-by: Moritz <mr-tz@users.noreply.github.com >
2023-08-15 12:26:19 +02:00
Willi Ballenthin
e6d64ef561
pydantic: remove use of deprecated routines
...
closes #1718
2023-08-15 08:41:56 +00:00
Willi Ballenthin
408c5076c6
tests: ida: don't collect tests as pytest tests
...
closes #1719
2023-08-15 08:26:59 +00:00
Willi Ballenthin
8479bc2f1f
Merge pull request #1720 from mandiant/fix/issue-1705
...
elf: detect Android OS via note and dependencies
2023-08-14 13:11:23 +02:00
Capa Bot
7c1522d84d
Sync capa-testfiles submodule
2023-08-14 11:11:05 +00:00
Willi Ballenthin
e6cb3d3b3b
os: detect Android via dependencies, too
2023-08-14 10:27:19 +00:00
Capa Bot
e5efc158b7
Sync capa-testfiles submodule
2023-08-10 07:26:08 +00:00
Aayush Goel
232c9ce35c
Add test for script & output rendered
2023-08-07 22:43:25 +05:30
Willi Ballenthin
74d9b06835
Merge pull request #1679 from Aayush-Goel-04/Aayush-Goel-04/Issue#1582
...
bump pydantic to 2.1.1
2023-08-07 12:02:53 +02:00
Capa Bot
2c8f99143a
Sync capa-testfiles submodule
2023-08-05 16:40:13 +00:00
Capa Bot
ee68031d19
Sync capa-testfiles submodule
2023-08-05 16:37:46 +00:00
Aayush Goel
2bed3468f6
bump pydantic to 2.1.1
2023-08-03 17:21:46 +05:30
Willi Ballenthin
727ece499a
Merge pull request #1662 from Aayush-Goel-04/Aayush-Goel-04/Issue#1607
...
ELF: Implement file import and export name extractor
2023-08-02 13:15:32 +02:00
Aayush Goel
62f50265bc
Resolved Import address
2023-08-02 16:41:24 +05:30
Capa Bot
d18224eac6
Sync capa-testfiles submodule
2023-08-02 11:03:16 +00:00
Aayush Goel
26935ee6e6
Update test_elffile_features.py
2023-08-02 13:51:51 +05:30
Aayush Goel
f8c499fb43
Added test for elf import/export handling
2023-08-02 11:52:27 +05:30
Capa Bot
d12185d851
Sync capa-testfiles submodule
2023-08-01 11:21:02 +00:00
Xusheng
8f826cb92d
Fix binja backend stack string detection. Re-enable binja stack string unit test
2023-07-24 19:15:35 +08:00
Willi Ballenthin
40793eeefb
tests: bn: update link to tracking issue
2023-07-17 18:07:25 +02:00
Willi Ballenthin
221a5a9f03
tests: xfail binja forwarded exports
2023-07-17 17:56:33 +02:00
Willi Ballenthin
ebae5e5ca0
Merge branch 'master' into fix/issue-1624
2023-07-13 16:51:41 +02:00
Capa Bot
244d56e32a
Sync capa-testfiles submodule
2023-07-13 14:50:40 +00:00
Willi Ballenthin
5f2b92de40
Merge branch 'master' into fix/issue-1624
2023-07-13 16:50:35 +02:00
Capa Bot
1065ff9779
Sync capa-testfiles submodule
2023-07-13 14:49:40 +00:00
Willi Ballenthin
82223dcdc9
conftest: isort
2023-07-13 13:12:13 +00:00
Willi Ballenthin
724f9e4b81
conftest: isort
2023-07-13 14:52:05 +02:00
Willi Ballenthin
c4da4bcfe7
conftest: update noqa ignores
2023-07-13 14:35:09 +02:00
Willi Ballenthin
fd36946c4b
conftest: import symbols prefixed with _
2023-07-13 14:32:24 +02:00
Willi Ballenthin
394c3807c1
Merge branch 'master' into fix/issue-1624
2023-07-13 11:55:46 +02:00
Willi Ballenthin
21b2aac8b5
fixtures: add test cases for forwarded exports
2023-07-13 10:31:52 +02:00
