6ff08aeeaf
Merge branch 'master' into vmray-extractor
2024-08-17 02:15:01 +01:00
e402aab41d
Sync capa-testfiles submodule
2024-08-15 20:03:31 +00:00
d62734ecc2
Sync capa-testfiles submodule
2024-08-14 12:20:36 +00:00
40c7714c48
Sync capa-testfiles submodule
2024-08-13 14:59:22 +00:00
460590cec0
Sync capa-testfiles submodule
2024-08-13 14:59:00 +00:00
25d2ef30e7
Sync capa-testfiles submodule
2024-08-13 14:58:53 +00:00
c0a7f765c5
Merge branch 'master' into vmray-extractor
2024-08-09 13:58:45 +02:00
0d87bb0504
Sync capa-testfiles submodule
2024-08-07 08:51:38 +00:00
9dd39926d7
Sync capa-testfiles submodule
2024-08-05 09:36:34 +00:00
e47635455e
add dynamic vmray feature tests
2024-07-31 13:30:30 +00:00
3982356945
load gzipped rd, see capa-testfiles#245
2024-07-31 12:59:16 +00:00
f471386456
vmray: merge upstream and fix conflicts
2024-07-24 10:02:07 -06:00
cf3494d427
Add a Feature Extractor for the Drakvuf Sandbox ( #2143 )
...
* initial commit
* update changelog
* Update CHANGELOG.md
* Update pyproject.toml
* Apply suggestions from code review: Typos
Co-authored-by: Vasco Schiavo <115561717+VascoSch92@users.noreply.github.com >
* capa/helpers.py: update if/else statement
Co-authored-by: Vasco Schiavo <115561717+VascoSch92@users.noreply.github.com >
* loader.py: replace print() statement with log.info()
* Update capa/features/extractors/drakvuf/models.py
Co-authored-by: Moritz <mr-tz@users.noreply.github.com >
* extractors/drakvuf/call.py: yield arguments right to left
* extractors/drakvuf/file.py: add a TODO comment for extracting more file features
* extractors/drakvuf/global_.py: add arch extraction
* extractors/drakvuf/helpers.py: ignore null pids
* capa/helpers.py: mention msgspec.json explicitely
* capa/helpers.py: generalize empty sandbox reports error logging
* capa/loader.py: log jsonl garbage collection into debug
* features/extractors/drakvuf/models.py: add documentation for SystemCall class
* capa/main.py: fix erroneous imports
* drakvuf extractor: fixed faulty type annotations
* fix black formatting
* fix flake8 issues
* drakvuf file extraction: add link to tracking issue
* drakvuf reports: add the ability to read gzip-compressed report files
* capa/helpers.py: fix mypy issues
* apply review comments
* drakvuf/helpers.py: add more information about null pid
* drakvuf/file.py: remove discovered_dlls file strings extraction
* capa/helpers.py: add comments for the dynamic extensions
* capa/helpers.py: log bad lines
* capa/helpers.py: add gzip support for reading one jsonl line
* drakvuf/helpers.py: add comment for sort_calls()
* tests/fixtures.py: add TODO for unifying CAPE and Drakvuf tests
* drakvuf/models.py: add TODO comment for supporting more drakvuf plugins
* tests/fixtures.py: remove obsolete file strings tests
* Update capa/main.py
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* Update capa/features/extractors/drakvuf/models.py
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* Update capa/features/extractors/drakvuf/models.py
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* Update capa/features/extractors/drakvuf/call.py
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* Update CHANGELOG.md
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* Update capa/features/extractors/drakvuf/helpers.py
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* review comments
* Update capa/features/extractors/drakvuf/extractor.py
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* Update capa/features/extractors/drakvuf/models.py
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* styling
* drakvuf/extractor.py: black linting
* drakvuf/models.py: remove need to empty report checking
* tests: add drakvuf models test
* Update capa/features/extractors/drakvuf/global_.py
Co-authored-by: msm-cert <156842376+msm-cert@users.noreply.github.com >
* Update tests/test_cape_features.py
Co-authored-by: msm-cert <156842376+msm-cert@users.noreply.github.com >
* Update capa/features/extractors/drakvuf/models.py
Co-authored-by: msm-cert <156842376+msm-cert@users.noreply.github.com >
* Apply suggestions from code review: rename Drakvuf to DRAKVUF
Co-authored-by: msm-cert <156842376+msm-cert@users.noreply.github.com >
* drakvuf/call.py: use int(..., 0) instead of str_to_number()
* remove str_to_number
* drakvuf/call.py: yield argument memory address value as well
* Update call.py: remove verbosity in yield statement
* Update call.py: yield missing address as well
* drakvuf/call.py: yield entire argument string only
* update readme.md
* Update README.md: typo
* Update CHANGELOG.md
Co-authored-by: msm-cert <156842376+msm-cert@users.noreply.github.com >
---------
Co-authored-by: Vasco Schiavo <115561717+VascoSch92@users.noreply.github.com >
Co-authored-by: Moritz <mr-tz@users.noreply.github.com >
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
Co-authored-by: msm-cert <156842376+msm-cert@users.noreply.github.com >
2024-07-24 14:22:21 +02:00
cbdc7446aa
vmray: merge upstream
2024-07-23 09:49:40 -06:00
3b94961133
vmray: complete pefile model tests
2024-07-19 15:50:07 -06:00
6ef485f67b
vmray: refactor model tests
2024-07-19 15:44:53 -06:00
4dfc53a58f
vmray: refactor model tests
2024-07-19 15:42:04 -06:00
4490097e11
vmray: add summary_v2.json model tests
2024-07-19 15:28:47 -06:00
28792ec6a6
vmray: add model tests for FunctionCall
2024-07-19 13:56:46 -06:00
da6c6cfb48
Update Binary Ninja version to 4.1 and use Python 3.9 to test it ( #2212 )
2024-07-19 02:28:10 +02:00
120f34e8ef
Sync capa-testfiles submodule
2024-07-02 07:56:15 +00:00
fccb533841
test/scripts.py: bugfix
2024-07-01 21:59:28 +01:00
3b165c3d8e
test:scripts.py: add tests for show-features.py process filtering
2024-07-01 21:41:46 +01:00
1975b6455c
extract import / export symbols from stripped elf binaries ( #2142 )
2024-06-18 12:38:02 -06:00
1360e08389
Sync capa-testfiles submodule
2024-06-18 11:00:26 +00:00
8726de0d65
ELF: Detect OS from Go binaries ( #1987 )
...
* elf: read segment memory size
* elf: add routine to read mapped memory
* elf: better detect OS for binaries compiled by Go
* elf: guess OS from Go source filenames
* changelog
* elf: mypy
* merge
* elf: add OS detection based on vDSO strings
* elf: document VTGrep searches
* elf: describe further technique to identify Go binaries
* elf: search for `.go.buildinfo` section via @yelhamer
* black
* elf: detect Alpine Linux ident
* elf: log interest symtab entries
* tests: add test for OS detection by Go buildinfo
* loader: handle missing viv modules
* pre-commit: run deptry before tests (which are slow)
* loader: describe removing viv symbolic switch solver
* pyproject: add PyGithub for deptry
* black
2024-06-13 13:23:47 +02:00
7d1512a3de
Merge pull request #2146 from mandiant/fix/2145
...
fix black and mypy
2024-06-13 11:49:18 +02:00
73d76d7aba
Sync capa-testfiles submodule
2024-06-13 09:30:44 +00:00
97a3fba2c9
fix black
2024-06-12 09:24:16 +00:00
52e24e560b
FEAT(capa2sarif) Add SARIF conversion script from json output ( #2093 )
...
* feat(capa2sarif): add new sarif conversion script converting json output to sarif schema, update dependencies, and update changelog
* fix(capa2sarif): removing copy and paste transcription errors
* fix(capa2sarif): remove dependencies from pyproject toml to guarded import statements
* chore(capa2sarif): adding node in readme specifying dependency and applied auto formatter for styling
* style(capa2sarif): applied import sorting and fixed typo in invocations function
* test(capa2sarif): adding simple test for capa to sarif conversion script using existing result document
* style(capa2sarif): fixing typo in version string in usage
* style(capa2sarif): isort failing due to reordering of typehint imports
* style(capa2sarif): fixing import order as isort on local machine was not updating code
---------
Co-authored-by: ReversingWithMe <ryanv@rewith.me >
Co-authored-by: Willi Ballenthin <wballenthin@google.com >
2024-06-11 15:01:26 +02:00
76a4a5899f
test_scripts: avoid unsupported logic combinations
2024-06-07 05:54:49 +02:00
b068890fa6
rules: match: optimize rule matching by better indexing rule by features
...
Implement the "tighten rule pre-selection" algorithm described here:
https://github.com/mandiant/capa/issues/2063#issuecomment-2100498720
In summary:
> Rather than indexing all features from all rules,
> we should pick and index the minimal set (ideally, one) of
> features from each rule that must be present for the rule to match.
> When we have multiple candidates, pick the feature that is
> probably most uncommon and therefore "selective".
This seems to work pretty well. Total evaluations when running against
mimikatz drop from 19M to 1.1M (wow!) and capa seems to match around
3x more functions per second (wow wow).
When doing large scale runs, capa is about 25% faster when using the
vivisect backend (analysis heavy) or 3x faster when using the
upcoming BinExport2 backend (minimal analysis).
2024-06-07 05:54:49 +02:00
5239e40beb
Sync capa-testfiles submodule
2024-06-05 12:15:41 +00:00
0cf9365816
Sync capa-testfiles submodule
2024-06-05 08:49:12 +00:00
30d23c4d97
render maec/* fields ( #2087 )
...
* Render maec/* fields
* add test for render_maec
---------
Co-authored-by: Soufiane Fariss <soufiane.fariss@um5s.net.ma >
Co-authored-by: Moritz <mr-tz@users.noreply.github.com >
2024-06-05 10:31:13 +02:00
b3ed42f5f9
Sync capa-testfiles submodule
2024-06-04 21:25:58 +00:00
1ec1185850
Sync capa-testfiles submodule
2024-06-02 14:32:18 +00:00
8ad74ddbb6
fix typos
2024-06-01 11:48:19 -07:00
267f5e99b7
Sync capa-testfiles submodule
2024-06-01 10:19:40 +00:00
4f2494dc59
Sync capa-testfiles submodule
2024-05-31 09:35:22 +00:00
0622f45208
Sync capa-testfiles submodule
2024-05-28 13:44:27 +00:00
ee98548bf9
Sync capa-testfiles submodule
2024-05-07 22:20:48 +00:00
6869ef6520
engine, common: use FeatureSet type annotation for evaluate signature
...
It was used in some places already, but now used everywhere consistently.
This should make it easier to refactor the FeatureSet type, if necessary,
because its easier to see all the places its used.
2024-05-07 15:20:50 +02:00
984c1b2d39
Sync capa-testfiles submodule
2024-04-23 16:47:43 +00:00
f44b4ebebd
Sync capa-testfiles submodule
2024-04-19 12:32:37 +00:00
e3a9c75316
Sync capa-testfiles submodule
2024-04-09 10:47:12 +00:00
2a54689cc6
Sync capa-testfiles submodule
2024-04-09 08:33:18 +00:00
7debc54dbd
Sync capa-testfiles submodule
2024-03-24 08:31:37 +00:00
9a5f4562b8
Merge branch 'master' into test_binja_4_0
2024-03-21 12:13:41 +01:00
0eb4291b25
Updating copyright across all files based on when it was first introduced. ( #2027 )
...
* updating copyright, back to the date of origin of file
* updating regex to account for linter violation
2024-03-13 14:04:53 +01:00
Yacine