gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2026-06-30 02:03:56 -07:00
Code Issues Packages Projects Releases Wiki Activity
3,050 Commits 55 Branches 49 Tags
b10196cdac6b4794de221b46fe2336098c3cf5cd
Commit Graph

3050 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Moritz 3347245c2e Merge pull request #1003 from mandiant/dependabot/pip/viv-utils-flirt--0.7.1 
build(deps): bump viv-utils[flirt] from 0.6.11 to 0.7.1
 2022-04-26 21:09:13 +02:00
Moritz 3e8e88c363 Merge pull request #1002 from mandiant/dependabot/pip/types-requests-2.27.20 
build(deps-dev): bump types-requests from 2.27.19 to 2.27.20
 2022-04-26 21:08:54 +02:00
Moritz e4dfa45057 Merge pull request #1001 from mandiant/dependabot/pip/types-pyyaml-6.0.7 
build(deps-dev): bump types-pyyaml from 6.0.6 to 6.0.7
 2022-04-26 21:08:44 +02:00
Moritz b58e90e8dd Merge pull request #1000 from mandiant/dependabot/pip/pytest-7.1.2 
build(deps-dev): bump pytest from 7.1.1 to 7.1.2
 2022-04-26 21:08:31 +02:00
dependabot[bot] 0e18cea11a build(deps): bump viv-utils[flirt] from 0.6.11 to 0.7.1 
Bumps [viv-utils[flirt]](https://github.com/williballenthin/viv-utils) from 0.6.11 to 0.7.1.
- [Release notes](https://github.com/williballenthin/viv-utils/releases)
- [Commits](https://github.com/williballenthin/viv-utils/compare/v0.6.11...v0.7.1)

---
updated-dependencies:
- dependency-name: viv-utils[flirt]
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-04-25 14:13:34 +00:00
dependabot[bot] e950932e43 build(deps-dev): bump types-requests from 2.27.19 to 2.27.20 
Bumps [types-requests](https://github.com/python/typeshed) from 2.27.19 to 2.27.20.
- [Release notes](https://github.com/python/typeshed/releases)
- [Commits](https://github.com/python/typeshed/commits)

---
updated-dependencies:
- dependency-name: types-requests
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-04-25 14:13:31 +00:00
dependabot[bot] 45738773ca build(deps-dev): bump types-pyyaml from 6.0.6 to 6.0.7 
Bumps [types-pyyaml](https://github.com/python/typeshed) from 6.0.6 to 6.0.7.
- [Release notes](https://github.com/python/typeshed/releases)
- [Commits](https://github.com/python/typeshed/commits)

---
updated-dependencies:
- dependency-name: types-pyyaml
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-04-25 14:13:28 +00:00
dependabot[bot] 054bcc9cb8 build(deps-dev): bump pytest from 7.1.1 to 7.1.2 
Bumps [pytest](https://github.com/pytest-dev/pytest) from 7.1.1 to 7.1.2.
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pytest-dev/pytest/compare/7.1.1...7.1.2)

---
updated-dependencies:
- dependency-name: pytest
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-04-25 14:13:26 +00:00
Moritz 4d49b749c5 Merge pull request #998 from mandiant/dependabot/pip/types-tabulate-0.8.7 
build(deps-dev): bump types-tabulate from 0.8.6 to 0.8.7
 2022-04-20 17:53:08 +02:00
Moritz 4d86774266 Merge pull request #997 from mandiant/dependabot/pip/types-colorama-0.4.12 
build(deps-dev): bump types-colorama from 0.4.10 to 0.4.12
 2022-04-20 17:52:57 +02:00
Moritz 20171fe4f2 Merge pull request #995 from mandiant/dependabot/pip/types-psutil-5.8.22 
build(deps-dev): bump types-psutil from 5.8.20 to 5.8.22
 2022-04-20 17:52:40 +02:00
dependabot[bot] 308a47a784 build(deps-dev): bump types-tabulate from 0.8.6 to 0.8.7 
Bumps [types-tabulate](https://github.com/python/typeshed) from 0.8.6 to 0.8.7.
- [Release notes](https://github.com/python/typeshed/releases)
- [Commits](https://github.com/python/typeshed/commits)

---
updated-dependencies:
- dependency-name: types-tabulate
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-04-20 15:48:18 +00:00
dependabot[bot] 2226bf0faa build(deps-dev): bump types-psutil from 5.8.20 to 5.8.22 
Bumps [types-psutil](https://github.com/python/typeshed) from 5.8.20 to 5.8.22.
- [Release notes](https://github.com/python/typeshed/releases)
- [Commits](https://github.com/python/typeshed/commits)

---
updated-dependencies:
- dependency-name: types-psutil
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-04-20 15:48:17 +00:00
dependabot[bot] 65cf8509f9 build(deps-dev): bump types-colorama from 0.4.10 to 0.4.12 
Bumps [types-colorama](https://github.com/python/typeshed) from 0.4.10 to 0.4.12.
- [Release notes](https://github.com/python/typeshed/releases)
- [Commits](https://github.com/python/typeshed/commits)

---
updated-dependencies:
- dependency-name: types-colorama
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-04-20 15:48:15 +00:00
Moritz 523ec7f453 Merge pull request #996 from mandiant/dependabot/pip/types-pyyaml-6.0.6 
build(deps-dev): bump types-pyyaml from 6.0.5 to 6.0.6
 2022-04-20 17:47:32 +02:00
Moritz 8a1bc39eb2 Merge pull request #994 from mandiant/dependabot/pip/types-requests-2.27.19 
build(deps-dev): bump types-requests from 2.27.16 to 2.27.19
 2022-04-20 17:45:36 +02:00
dependabot[bot] fd1785fe65 build(deps-dev): bump types-pyyaml from 6.0.5 to 6.0.6 
Bumps [types-pyyaml](https://github.com/python/typeshed) from 6.0.5 to 6.0.6.
- [Release notes](https://github.com/python/typeshed/releases)
- [Commits](https://github.com/python/typeshed/commits)

---
updated-dependencies:
- dependency-name: types-pyyaml
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-04-18 14:12:43 +00:00
dependabot[bot] 45c22a24a6 build(deps-dev): bump types-requests from 2.27.16 to 2.27.19 
Bumps [types-requests](https://github.com/python/typeshed) from 2.27.16 to 2.27.19.
- [Release notes](https://github.com/python/typeshed/releases)
- [Commits](https://github.com/python/typeshed/commits)

---
updated-dependencies:
- dependency-name: types-requests
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-04-18 14:12:38 +00:00
Willi Ballenthin c236293185 features: insn: number: allow floats, too 2022-04-08 18:41:19 -06:00
Willi Ballenthin bfb6d4d142 dn: fix access to ctx 2022-04-08 18:41:09 -06:00
Willi Ballenthin 723efe1755 address: better implement .NET token 2022-04-08 18:40:58 -06:00
Willi Ballenthin e029547035 show-features: learn to use Addresses 2022-04-08 18:33:49 -06:00
Willi Ballenthin d9ede95cf7 dnfile: use Address 2022-04-08 18:33:39 -06:00
Willi Ballenthin 70c3487bc7 address: better implement .NET token 2022-04-08 18:33:23 -06:00
Willi Ballenthin 808b7fb4dc dnfile: fix types 2022-04-08 18:33:12 -06:00
Willi Ballenthin ed1009096d Merge branch 'master' of github.com:mandiant/capa into feature-981 2022-04-08 16:01:59 -06:00
Mike Hunhoff 580a2d7e45 dotnet: basic detection and feature extraction (#987) 2022-04-08 14:55:00 -06:00
Willi Ballenthin 87d3d6c577 smda: use Addresses 2022-04-08 13:15:04 -06:00
Willi Ballenthin ae87fa1785 elf: use addresses 2022-04-08 12:49:48 -06:00
Willi Ballenthin 2b00bc0fdb pep8 2022-04-08 12:46:43 -06:00
Willi Ballenthin 43b8ad80c7 pefile: extract Addresses 2022-04-08 12:45:46 -06:00
Willi Ballenthin 65b462f62c render: format various address types differently 2022-04-08 12:39:10 -06:00
Willi Ballenthin 7e7740cf77 viv: insn: use handles for code merged from master 2022-04-08 12:38:46 -06:00
Willi Ballenthin a3d1b1403c address: fix min value for unsigned addresses 2022-04-08 12:38:21 -06:00
Willi Ballenthin 31977e6523 changelog 2022-04-08 12:19:50 -06:00
Willi Ballenthin 9164713dd9 Merge branch 'dotnet-main' of github.com:mandiant/capa into feature-981 2022-04-08 12:17:16 -06:00
Willi Ballenthin bfb01e3729 extractor: viv: use handles throughout 2022-04-08 11:54:27 -06:00
Willi Ballenthin fc1709ba6c extractor: add types throughout 2022-04-08 11:53:42 -06:00
Willi Ballenthin 1b79aae836 extractor: introduce standardized handles for function, bb, insn 2022-04-08 11:46:07 -06:00
Willi Ballenthin 6355fb3f3e add Address abstraction to handle various ways of identifing things in files 2022-04-08 11:44:24 -06:00
Moritz c8a772d19a test: update dotnet dirs and sync master (#984) 2022-04-08 09:34:22 -06:00
Capa Bot 5bc44aef0f Sync capa-testfiles submodule 2022-04-08 10:34:02 +00:00
Willi Ballenthin b455b67da3 Merge pull request #977 from mandiant/feature-320 
extract extra offset/number features
 2022-04-07 14:20:10 -06:00
Willi Ballenthin 351d70aafe smda: implement additional offset and number features 2022-04-07 12:56:24 -06:00
Willi Ballenthin 8a2276f398 smda: implement operand number/offset features 
cause its not too hard
 2022-04-07 12:48:25 -06:00
Moritz 65552575f8 Update dotnet-main (#979) 
* Sync capa rules submodule

* Sync capa-testfiles submodule

* Sync capa rules submodule

* changelog

* *: remove /x32 and /x64 flavors from number and offset features

* *: remove more references to /x32 and /x64

* linter: accept instruction scope

* rules: fix max operand index (4)

* API: better support A/W functions

* vverbose: show lib rule matches

* main: accept multiple paths to rules

* main: fix removal of default rules path

* lint: fix rules path

* changelog

* capa_as_library: fix rules path is list now

* main: better handle multiple rules paths

* main: bail if python 3.6 or below

closes #964

* ida: readme: remove python 3.6 support

* capa2yara: fix rules paths

* render: meta: display rule paths on separate lines

closes #971

* render: verbose: add doc

* verbose: make rule path multiline more concise

* vverbose: don't show examples in output

closes #970

* vverbose: render subscope name, like "basic block:"

closes #963

* build(deps-dev): bump pytest from 7.0.1 to 7.1.1

Bumps [pytest](https://github.com/pytest-dev/pytest) from 7.0.1 to 7.1.1.
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pytest-dev/pytest/compare/7.0.1...7.1.1)

---
updated-dependencies:
- dependency-name: pytest
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* ci: build: update pip and setuptools

* ci: build: bump pyinstall to v4.10

* Sync capa rules submodule

* Dotnet mixed mode detect (#969)

* feat: start dotnet detection (#955)

* feat: start dotnet detection

* Apply suggestions from code review

Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>

* refactor: dn instead of dotnet

* refactor: format branches, extractor reorg

* refactor: format selection and dotnet detect

* feat: get format, arch, os

* refactor: log errors and exceptions

* ci: also test and build for dotnet-main dev

* fix: import path

* fix: circular dep

* fix: remove buf argument
feat: get runtime meta data

* fix: log unsupported runtime error

* fix: type ignore

Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>

* fix: imports and add tests

* feat: detect mixed mode and tests

* feat: start dotnet detection (#955)

* feat: start dotnet detection

* Apply suggestions from code review

Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>

* refactor: dn instead of dotnet

* refactor: format branches, extractor reorg

* refactor: format selection and dotnet detect

* feat: get format, arch, os

* refactor: log errors and exceptions

* ci: also test and build for dotnet-main dev

* fix: import path

* fix: circular dep

* fix: remove buf argument
feat: get runtime meta data

* fix: log unsupported runtime error

* fix: type ignore

Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>

* fix: imports and add tests

Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>

* test: checkout submodules recursively

Co-authored-by: Capa Bot <capa-dev@mandiant.com>
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2022-04-07 17:45:29 +02:00
Capa Bot 4c84a77053 Sync capa rules submodule 2022-04-07 07:50:51 +00:00
Willi Ballenthin 6b810a1f72 ida: insn: look for numbers in displ, not phrase 2022-04-06 15:41:17 -06:00
Willi Ballenthin c36bde0f2d ida: insn: ignore numbers when SIB present 2022-04-06 15:38:04 -06:00
Willi Ballenthin 1a44dd8a2b insn: better detect offset/numbers 2022-04-06 15:12:59 -06:00