Moritz
38668b2c4a
fix: use DnfileFeatureExtractor ( #1088 )
...
closes #1087
2022-07-05 07:53:47 +02:00
Willi Ballenthin
8b7ddc5679
linter: expect file path "dotnet" for ".NET" rules
...
ref: https://github.com/mandiant/capa-rules/pull/568#discussion_r908718249
2022-06-28 10:48:03 -06:00
Moritz Raabe
9bf582a89a
feat: lint check value types
...
closes #1027
2022-06-28 12:53:31 +02:00
Willi Ballenthin
1a290a38c4
Merge branch 'master' into feature-981
2022-06-06 14:07:51 -06:00
Willi Ballenthin
867662ba5a
rules: remove unused rule-category meta
2022-06-06 13:43:44 -06:00
Moritz Raabe
1df60186f0
fix!: authors instead of author
2022-05-31 23:05:13 +02:00
Willi Ballenthin
4ae4bab254
lint: use meta.authors
2022-05-26 12:02:47 -06:00
Willi Ballenthin
9236a36ef4
rule: factor out is subscope check
2022-05-26 10:24:31 -06:00
Mike Hunhoff
580a2d7e45
dotnet: basic detection and feature extraction ( #987 )
2022-04-08 14:55:00 -06:00
Moritz
65552575f8
Update dotnet-main ( #979 )
...
* Sync capa rules submodule
* Sync capa-testfiles submodule
* Sync capa rules submodule
* changelog
* *: remove /x32 and /x64 flavors from number and offset features
* *: remove more references to /x32 and /x64
* linter: accept instruction scope
* rules: fix max operand index (4)
* API: better support A/W functions
* vverbose: show lib rule matches
* main: accept multiple paths to rules
* main: fix removal of default rules path
* lint: fix rules path
* changelog
* capa_as_library: fix rules path is list now
* main: better handle multiple rules paths
* main: bail if python 3.6 or below
closes #964
* ida: readme: remove python 3.6 support
* capa2yara: fix rules paths
* render: meta: display rule paths on separate lines
closes #971
* render: verbose: add doc
* verbose: make rule path multiline more concise
* vverbose: don't show examples in output
closes #970
* vverbose: render subscope name, like "basic block:"
closes #963
* build(deps-dev): bump pytest from 7.0.1 to 7.1.1
Bumps [pytest](https://github.com/pytest-dev/pytest ) from 7.0.1 to 7.1.1.
- [Release notes](https://github.com/pytest-dev/pytest/releases )
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst )
- [Commits](https://github.com/pytest-dev/pytest/compare/7.0.1...7.1.1 )
---
updated-dependencies:
- dependency-name: pytest
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
* ci: build: update pip and setuptools
* ci: build: bump pyinstall to v4.10
* Sync capa rules submodule
* Dotnet mixed mode detect (#969 )
* feat: start dotnet detection (#955 )
* feat: start dotnet detection
* Apply suggestions from code review
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* refactor: dn instead of dotnet
* refactor: format branches, extractor reorg
* refactor: format selection and dotnet detect
* feat: get format, arch, os
* refactor: log errors and exceptions
* ci: also test and build for dotnet-main dev
* fix: import path
* fix: circular dep
* fix: remove buf argument
feat: get runtime meta data
* fix: log unsupported runtime error
* fix: type ignore
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* fix: imports and add tests
* feat: detect mixed mode and tests
* feat: start dotnet detection (#955 )
* feat: start dotnet detection
* Apply suggestions from code review
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* refactor: dn instead of dotnet
* refactor: format branches, extractor reorg
* refactor: format selection and dotnet detect
* feat: get format, arch, os
* refactor: log errors and exceptions
* ci: also test and build for dotnet-main dev
* fix: import path
* fix: circular dep
* fix: remove buf argument
feat: get runtime meta data
* fix: log unsupported runtime error
* fix: type ignore
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* fix: imports and add tests
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* test: checkout submodules recursively
Co-authored-by: Capa Bot <capa-dev@mandiant.com >
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-04-07 17:45:29 +02:00
Moritz
b5be876e61
feat: start dotnet detection ( #955 )
...
* feat: start dotnet detection
* Apply suggestions from code review
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* refactor: dn instead of dotnet
* refactor: format branches, extractor reorg
* refactor: format selection and dotnet detect
* feat: get format, arch, os
* refactor: log errors and exceptions
* ci: also test and build for dotnet-main dev
* fix: import path
* fix: circular dep
* fix: remove buf argument
feat: get runtime meta data
* fix: log unsupported runtime error
* fix: type ignore
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
2022-04-06 11:33:14 +02:00
Willi Ballenthin
11b773573e
lint: fix rules path
2022-04-05 17:17:44 -06:00
Willi Ballenthin
f923a4ea9b
linter: accept instruction scope
2022-04-05 12:24:41 -06:00
Willi Ballenthin
bd6e62e9bf
Update scripts/lint.py
...
Co-authored-by: Moritz <mr-tz@users.noreply.github.com >
2022-03-29 11:26:21 -06:00
Willi Ballenthin
963cfbf380
pep8
2022-03-28 13:17:35 -06:00
Baptistin Boilot
d026d21073
linter: add MBC names and IDs to the linting script
2022-02-06 11:47:49 +01:00
Baptistin Boilot
377c805fe7
linter: improve linter-data.json opening and add documentation
...
- Open linter-data.json in byte mode
- Add a comment explaining how to invoke the script
2022-01-24 22:48:59 +01:00
Baptistin Boilot
2bcd725e04
linter: add the possibility to enable or disable mbc and att&ck linting
2022-01-22 16:45:47 +01:00
Baptistin Boilot
0b487546bb
linter: add mbc data extractor and linter
2022-01-22 16:45:46 +01:00
Baptistin Boilot
67d8d832c9
linter: refactor att&ck linter and add attck json data
2022-01-22 16:45:35 +01:00
Baptistin Boilot
fa99782f02
linter: add a linter rule that checks for invalid att&ck technique
2022-01-22 16:44:07 +01:00
William Ballenthin
e550d48bcd
linter: optional maps to some, not range
2021-11-10 14:13:37 -07:00
William Ballenthin
72c2ffc40b
linter: add checks for not and optional not under and
2021-11-10 13:47:30 -07:00
Moritz Raabe
e9170a1d4b
auto recognize shellcode based on file extension
2021-11-02 18:02:37 +01:00
Moritz Raabe
8de69c639a
s/fireeye/mandiant
2021-09-29 12:55:16 +02:00
William Ballenthin
282c0c2655
lint: guide mypy typing to address CI issues
2021-08-27 13:00:40 -06:00
William Ballenthin
b5860190e3
linter: invoke gc
2021-08-27 09:47:34 -06:00
William Ballenthin
f5b2efdc87
lint: reduce logging verbosity
2021-08-27 09:36:32 -06:00
William Ballenthin
fab26180cb
lint: cache analysis results per path
2021-08-27 09:24:36 -06:00
William Ballenthin
3968d40bf4
linter: use pathlib.Path
2021-08-27 09:11:28 -06:00
William Ballenthin
cb2d1cde36
linter: add typing
2021-08-27 09:04:37 -06:00
William Ballenthin
da7a9b7232
linter: don't show noisey "need example" warnings in nursery
2021-08-27 08:42:46 -06:00
William Ballenthin
4f15225665
lint: handle calls to print within pbar
2021-08-27 08:34:02 -06:00
William Ballenthin
90708c123b
linter: show progress bar
2021-08-27 08:21:09 -06:00
William Ballenthin
8195b7565f
lint: hardcoded some exports of ntdll/ntoskrnl to reduce warning spam
2021-08-25 16:36:36 -06:00
William Ballenthin
0569f9b242
lint: show mod/imp names per rule
...
fix bug where the same mod/imp name pair was shown for all rules
2021-08-25 16:36:08 -06:00
William Ballenthin
d8c8c6d2f3
lint: apply string lints to substrings, too
2021-08-24 11:52:28 -06:00
William Ballenthin
a7ebd5a309
Merge branch 'master' of github.com:fireeye/capa into fix-507
2021-06-15 12:28:17 -06:00
William Ballenthin
7f03db9fe4
main: dont save .viv by default, unless CAPA_SAVE_WORKSPACE set
...
closes #507
2021-06-15 12:24:01 -06:00
William Ballenthin
83909b2be4
*: remove explicit object super class
...
closes #635
2021-06-14 08:47:09 -06:00
William Ballenthin
ac59e50b5f
move capa/features/__init__.py logic to common.py
...
also cleanup imports across the board,
thanks to pylance.
2021-06-09 22:20:53 -06:00
William Ballenthin
2706a7171e
linter: fix match namespace handling
...
closes #601
2021-06-01 11:38:05 -06:00
Moritz Raabe
204d8b36df
add or/optional lint and colors
...
closes #348
2021-05-25 16:32:47 +02:00
William Ballenthin
9b1400c23a
pep8
2021-05-19 16:14:37 -06:00
William Ballenthin
60d77759f2
Merge branch 'feature-571' of github.com:fireeye/capa into feature-571
2021-05-19 16:14:09 -06:00
Willi Ballenthin
5fc705856d
Merge branch 'master' into feature-571
2021-05-20 16:40:37 -06:00
William Ballenthin
0a1adb99e0
lint: cleanup handling of nursery rules further
2021-05-19 16:13:45 -06:00
William Ballenthin
3eef034a94
lint: better handling of nursery rule summary
2021-05-19 16:06:07 -06:00
Moritz Raabe
586726fb13
lint statements for single child statements
2021-05-19 18:25:14 +02:00
William Ballenthin
ff88393248
linter: summarize status at end
...
closes #571
2021-05-18 15:19:34 -06:00
