William Ballenthin
612eefe2e8
dos2unix
2020-07-02 11:08:21 -06:00
William Ballenthin
8f7cb6dad0
pep8
2020-07-02 11:01:18 -06:00
William Ballenthin
41c32013bb
Merge branch 'master' into fmt-black
2020-07-02 11:00:14 -06:00
Willi Ballenthin
6f44d59eae
Merge pull request #77 from fireeye/fix/rendervv
...
fix render, cleanup feature string display
2020-07-02 11:00:57 -06:00
William Ballenthin
c6ac997a8d
setup: add formatting deps
2020-07-02 10:53:37 -06:00
William Ballenthin
1188103d1c
pep8: isort
2020-07-02 10:52:05 -06:00
Moritz Raabe
c37365f045
fix render, cleanup feature string display
2020-07-02 18:48:14 +02:00
William Ballenthin
5fda3c467f
tests: fix freeze test that was broken during merge
2020-07-02 10:40:16 -06:00
William Ballenthin
c185e9ef09
pep8: black
2020-07-02 10:32:26 -06:00
William Ballenthin
db2b1caeae
Merge branch 'master' into fmt-black
2020-07-02 10:25:24 -06:00
William Ballenthin
acbcd0c4b0
submodule: rules: update
2020-07-02 10:17:44 -06:00
Willi Ballenthin
e3aea925cc
Merge pull request #71 from fireeye/pyinstaller
...
pyinstaller working on linux/py2
2020-07-02 10:13:46 -06:00
Ana María Martínez Gómez
f6b54beb02
Merge pull request #39 from fireeye/ana-description
2020-07-02 17:07:04 +02:00
Ana María Martínez Gómez
152129cc25
Add tests for description feature
...
Test if the parsing of feature succeeds with every time of description.
2020-07-02 16:50:28 +02:00
Ana María Martínez Gómez
81741b49f7
Support inline descriptions for count
...
```
count(number(2 = AF_INET/SOCK_DGRAM)): 2
```
2020-07-02 16:50:22 +02:00
Ana María Martínez Gómez
64124c0b64
Remove True from Characteristic rules and output
...
Get rid of `True` in characteristic (rules, output and json) as it is
implicit. This way, the same syntax is used for characteristic as for
the rest of the features.
Co-authored-by: William Ballenthin <william.ballenthin@fireeye.com >
2020-07-02 16:50:15 +02:00
Ana María Martínez Gómez
681feebf35
Adapt description implementation to new output
...
As the `__str__` method is not used anymore in the output, the
description implementation needs to be adapted.
2020-07-02 16:50:07 +02:00
Ana María Martínez Gómez
767a76d814
Allow to add a description for every feature
...
Enable associate context for all features. This was called symbol before
and only enabled for `number`, `offset` and `bytes`.
This is not enabled for strings with regular expressions, as they are
not a feature.
2020-07-02 11:31:31 +02:00
Moritz
12671ea44b
Merge pull request #73 from fireeye/ana-fix-tests
...
Fix KeyError in Range#evaluate()
2020-07-02 11:30:42 +02:00
Ana María Martínez Gómez
f8cfb67d02
Fix KeyError in Range#evaluate()
...
If the key doesn't exist, `evaluate` raises a `KeyError` Exception,
making the tests fail.
2020-07-02 11:28:47 +02:00
Moritz
aac5ac71d2
Merge pull request #72 from fireeye/ana-linter-namespace
...
Fix get_features rule linter
2020-07-02 10:20:30 +02:00
William Ballenthin
d2ab09db5d
pyinstaller: embed capa version in exe
2020-07-02 01:38:06 -06:00
William Ballenthin
d0e962f9d0
pyinstaller: add wcwidth data files
2020-07-02 01:27:07 -06:00
Ana María Martínez Gómez
a80f38ec75
Fix get_features rule linter
...
To support matching namespaces `get_features()` get an extra parameters
which was missing in the rule linter.
2020-07-02 09:24:51 +02:00
William Ballenthin
36afed2d22
pyinstaller working on linux/py2
...
closes #40
2020-07-01 17:35:18 -06:00
Willi Ballenthin
8f6396c526
Merge pull request #69 from fireeye/capa-explorer-add-submodule-item-type
...
capa explorer: add subscope item type
2020-07-01 14:34:04 -06:00
Willi Ballenthin
bcd68b14b9
Merge pull request #70 from fireeye/capa-explorer-default-sort-order-for-reset
...
capa explorer: default sort asc when reset occurs
2020-07-01 14:33:21 -06:00
Willi Ballenthin
b31cad551c
Merge pull request #68 from fireeye/capa-explorer-support-multiple-range-locations
...
capa explorer: adding support for multiple locations under range
2020-07-01 14:32:50 -06:00
Michael Hunhoff
28ac48dd17
add default sort order asc when reset occurs
2020-07-01 13:54:00 -06:00
Michael Hunhoff
1cf36b5792
adding new item type for subscope to help render
2020-07-01 13:38:20 -06:00
Michael Hunhoff
65f75e517a
adding support for multiple locations under range
2020-07-01 13:26:00 -06:00
Willi Ballenthin
2a43557f5f
Merge pull request #64 from fireeye/fix-json-range-locations
...
render: json: include locations for range
2020-07-01 12:51:52 -06:00
William Ballenthin
92bea58347
ci: update tox with black ignores
2020-07-01 12:44:49 -06:00
William Ballenthin
b9d017ad10
pep8
2020-07-01 12:43:12 -06:00
William Ballenthin
23e70b4e85
pep8: scripts
2020-07-01 12:42:33 -06:00
William Ballenthin
d23ef48bb6
pep8
2020-07-01 12:33:13 -06:00
William Ballenthin
6229377408
render: vverbose: factor out rendering of locations
2020-07-01 12:10:52 -06:00
William Ballenthin
da9f8fede4
render: json: include locations for range
...
closes #43
2020-07-01 12:05:43 -06:00
Willi Ballenthin
d0886c4c0d
Merge pull request #61 from fireeye/fix-range-min-zero
...
rules: range: correct handling of range with min==0
2020-07-01 11:57:22 -06:00
Willi Ballenthin
f55c1ac604
Merge pull request #51 from fireeye/match-namespaces
...
engine, rules: support matching namespaces, not just rule names
2020-07-01 10:23:06 -06:00
Willi Ballenthin
089bf27f9c
Merge pull request #56 from fireeye/ana-fix-post-commit
...
Fix unrestored stashed changes in post-commit hook
2020-07-01 09:51:26 -06:00
Willi Ballenthin
1a36f60b85
Merge pull request #58 from fireeye/capa-explorer-support-doc-format
...
Capa explorer support doc format
2020-07-01 09:50:42 -06:00
Willi Ballenthin
de370e2bd0
Merge pull request #59 from fireeye/fix-bytes-display-vverbose
...
fix bug when rendering bytes feature in vverbose
2020-07-01 09:31:34 -06:00
Michael Hunhoff
ccdbd43cda
fix bug in bytes feture rendering
2020-07-01 08:47:43 -06:00
Michael Hunhoff
62a0dc4bb6
fixing supscope display
2020-07-01 07:58:54 -06:00
Michael Hunhoff
2e12504083
changes for upstream
2020-07-01 07:41:02 -06:00
Michael Hunhoff
5d83773036
merging upstream changes
2020-07-01 07:20:59 -06:00
Ana María Martínez Gómez
24792cd160
Fix unrestored stashed changes in post-commit hook
...
If the style checker of the rule linter failed, the stashed changes were
not restored. There is no reason to exist with an error code in a post
hook. In pre hooks this causes the action to be aborted.
2020-07-01 13:59:06 +02:00
Moritz Raabe
4d1449e3fa
sync rules
2020-07-01 09:53:57 +02:00
Moritz Raabe
7c542c3da9
Merge branch 'linter-lib-checks'
2020-07-01 09:31:53 +02:00
