Commit Graph

35 Commits

Author SHA1 Message Date
Willi Ballenthin b505ba7621 fix: remove unused imports and un-suppress F401
closes #2996
2026-05-08 17:58:07 +02:00
Aditya Pandey 3582bce6fd vmray: skip processes with invalid PID or missing filename (#2807) (#2845)
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
2026-02-05 12:11:26 -07:00
Mike Hunhoff 160ce73a35 vmray: loosen file checks to enable processing of additional file types (#2571)
* vmray: loosen file checks to enable addtional file types

* additional refactor to loosen file checks

* update CHANGELOG

* cleanup comments and small code refactor

* fix lints

* use NO_ADDRESS for submissions that don't have a base address

* update comments

* add test for ps1 trace
2025-01-23 12:47:36 -07:00
Ana Maria Martinez Gomez 3cd97ae9f2 [copyright + license] Fix headers
Replace the header from source code files using the following script:
```Python
for dir_path, dir_names, file_names in os.walk("capa"):
    for file_name in file_names:
        # header are only in `.py` and `.toml` files
        if file_name[-3:] not in (".py", "oml"):
            continue
        file_path = f"{dir_path}/{file_name}"
        f = open(file_path, "rb+")
        content = f.read()
        m = re.search(OLD_HEADER, content)
        if not m:
            continue
        print(f"{file_path}: {m.group('year')}")
        content = content.replace(m.group(0), NEW_HEADER % m.group("year"))
        f.seek(0)
        f.write(content)
```

Some files had the copyright headers inside a `"""` comment and needed
manual changes before applying the script. `hook-vivisect.py` and
`pyinstaller.spec` didn't include the license in the header and also
needed manual changes.

The old header had the confusing sentence `All rights reserved`, which
does not make sense for an open source license. Replace the header by
the default Google header that corrects this issue and keep capa
consistent with other Google projects.

Adapt the linter to work with the new header.

Replace also the copyright text in the `web/public/index.html` file for
consistency.
2025-01-15 08:52:42 -07:00
Moritz d1f3e43325 vmray: record command line info (#2515)
* vmray: record command line info
2024-12-03 19:56:30 +01:00
mr-tz 2987eeb0ac update type annotations
tmp
2024-10-22 09:38:25 +00:00
Moritz 06271a88d4 Fix VMRay missing process data (#2396)
* get all processes, see #2394

* add tests for process recording

* rename symbols for clarification

* handle single and list entries

* update changelog

* dynamic: vmray: use monitor IDs to track processes and threads

* dynamic: vmray: code refactor

* dynamic: vmray: add sanity checks when processing monitor processes

* dynamic: vmray: remove unnecessary keys() access

* dynamic: vmray: clarify comments

* Update CHANGELOG.md

Co-authored-by: Willi Ballenthin <wballenthin@google.com>

* dynamic: vmray: update CHANGELOG

---------

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
Co-authored-by: Willi Ballenthin <wballenthin@google.com>
2024-09-26 13:57:30 -06:00
Mike Hunhoff 1a3cf4aa8e vmray: update extractor.py format_params 2024-07-29 11:41:31 -06:00
Mike Hunhoff fd7bd94b48 vmray: remove outdated comments 2024-07-18 08:50:20 -06:00
Mike Hunhoff 330c77a32a vmray: implement get_call_name 2024-07-17 15:04:00 -06:00
Mike Hunhoff 19a6f3ad49 vmray: improve supported file type validation 2024-07-17 12:37:51 -06:00
Mike Hunhoff ec7e43193e vmray: update comment for extract_process_features 2024-07-17 12:10:18 -06:00
Mike Hunhoff 1f5b6ec52c vmray: improve comments 2024-07-12 19:00:48 -06:00
Mike Hunhoff da0545780b vmray: emit number call features for input parameters 2024-07-12 16:25:56 -06:00
Mike Hunhoff aad4854a61 vmray: use process OS PID instead of monitor ID 2024-07-12 11:33:13 -06:00
Mike Hunhoff 81581fe85e vmray: emit string file featureS 2024-07-12 10:15:28 -06:00
Mike Hunhoff 9df611ff13 vmray: add comments 2024-06-20 14:41:50 -06:00
Mike Hunhoff 4b08e62750 vmray: fix flake8 lints 2024-06-20 14:12:34 -06:00
Mike Hunhoff 9ef705a9ac vmray: remove old comments 2024-06-20 14:04:31 -06:00
Mike Hunhoff 19502efff3 vmray: connect process, thread, and call 2024-06-20 13:05:32 -06:00
Mike Hunhoff ec21f3b3fc vmray: use xmltodict instead of pydantic_xml to improve performance 2024-06-20 10:08:27 -06:00
Mike Hunhoff 5be68d0751 vmray: remove debug code and update call features entry point 2024-06-20 08:20:00 -06:00
mr-tz 0c9d3d09af fix ruff 2024-06-19 15:13:11 +00:00
mr-tz fbdfea1edc add testing code 2024-06-19 14:56:12 +00:00
Mike Hunhoff e5fa800ffb vmray: emit empty thread features 2024-06-18 14:45:08 -06:00
Mike Hunhoff b3ebf80d9b vmray: emit process name 2024-06-18 14:41:47 -06:00
Mike Hunhoff 8f32b7fc65 vmray: emit process handles 2024-06-18 14:32:11 -06:00
Mike Hunhoff f3d69529b0 vmray: invoke VMRay feature extractor from capa.main 2024-06-18 13:27:40 -06:00
Mike Hunhoff 8b913e0544 vmray: extract global features for PE files 2024-06-14 09:32:02 -06:00
Mike Hunhoff 00cb7924e1 vmray: clean up pydantic models and add sample hash extraction 2024-06-13 17:02:50 -06:00
Mike Hunhoff 346a0693ad vmray: clean up VMRayAnalysis 2024-06-13 16:48:12 -06:00
Mike Hunhoff 8d3f032434 vmray: clean up pydantic models and implement base address extraction 2024-06-13 16:43:23 -06:00
Mike Hunhoff ca02b4ac7c vmray: expand extractor to emit file export features 2024-06-13 14:12:41 -06:00
Mike Hunhoff a797405648 vmray: add example models for summary_v2.json 2024-06-13 12:54:59 -06:00
mr-tz a9dafe283c example using pydantic-xml to parse flog.xml 2024-06-13 16:37:45 +00:00