Josh Soref
d65d7bcd7e
spelling: notifications
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2023-01-04 00:32:39 -05:00
Josh Soref
00254b93dc
spelling: instruction
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2023-01-04 00:32:39 -05:00
Josh Soref
d29e7e6f3a
spelling: further
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2023-01-04 00:32:39 -05:00
Josh Soref
049e222e88
spelling: falls through
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2023-01-04 00:32:39 -05:00
Josh Soref
caef7812a3
spelling: disassembly
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2023-01-04 00:32:39 -05:00
Josh Soref
5396d5f99e
spelling: contiguous
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2023-01-04 00:25:22 -05:00
Moritz
3258556d5d
Merge pull request #1247 from mandiant/doc/rule-compat-info
...
update rule compatibility doc
2023-01-02 13:21:53 +01:00
Mike Hunhoff
5f77200108
explorer: assume 32-bit displacement for offsets ( #1250 )
...
* explorer: assume 32-bit displacement for offsets
2022-12-29 07:08:10 -07:00
mr-tz
ee90fc8761
update rule compatibility doc
2022-12-23 18:30:25 +01:00
Mike Hunhoff
b68be0c2ce
dotnet: emit namespace/class features for type references ( #1242 )
...
* dotnet: emit namespace/class features for type references
* dotnet: pre-compute .NET token caches
2022-12-21 15:59:29 -07:00
Mike Hunhoff
50490e6a93
dotnet: emit namespace/class features for ldvirtftn/ldftn instructions ( #1241 )
...
* dotnet: emit namespace/class features for ldvirtftn/ldftn instructions
* dotnet: add unit tests for ldftn/ldvirtftn namespace/class features
2022-12-20 13:29:29 -07:00
Mike Hunhoff
4ece47c64c
dotnet: emit calls to/from MethodDef methods ( #1236 )
...
* dotnet: emit calls to/from MethodDef methods
* dotnet: update function.py copyright header
2022-12-19 15:06:16 -07:00
Moritz
2b85af0f88
explorer: update and remove outdated documentation ( #1238 )
2022-12-19 14:53:16 -07:00
Mike Hunhoff
e0491097b0
dotnet: emit API features for generic methods ( #1231 )
...
* dotnet: emit API features for generic methods
* dotnet: improve type checking
* dotnet: emit namespace/class features for generic methods
* dotnet: update for dnfile 0.13.0
* dotnet: refactor property extraction
2022-12-19 14:45:21 -07:00
Mike Hunhoff
3af7fe0b08
dotnet: address unhandled exceptions through improved type checking ( #1230 )
...
* dotnet: bump dncil version
* dotnet: check #US stream valid before access
* dotnet: use assert statements to guard types
2022-12-15 12:55:57 -07:00
Willi Ballenthin
505910edb5
dotnet: remove duplicative validate_has_dotnet helper
2022-12-14 21:28:32 +01:00
Willi Ballenthin
aee0ec8016
features: cleanup mypy checking
2022-12-14 21:22:52 +01:00
Willi Ballenthin
501227f23f
elf: fix missing attribute
2022-12-14 11:14:01 +01:00
Willi Ballenthin
56d075fd32
typing
2022-12-14 11:08:46 +01:00
Willi Ballenthin
9ae908c741
elf: better format attribution declarations
2022-12-14 10:57:27 +01:00
Willi Ballenthin
81500a4d1d
black
2022-12-14 10:48:00 +01:00
Willi Ballenthin
b819033da0
lots of mypy
2022-12-14 10:37:39 +01:00
Willi Ballenthin
b1d6fcd6c8
mypy
2022-12-13 13:20:24 +01:00
Mike Hunhoff
447cd95bc5
ida: add support for COFF and extern functions ( #1223 )
2022-12-12 16:36:44 -07:00
Willi Ballenthin
0f902124d1
elf: reduce logging verbosity
2022-12-12 11:43:48 +01:00
Willi Ballenthin
d4a218e268
elf: os: bug fixes
2022-12-12 11:41:01 +01:00
Willi Ballenthin
c958a6a286
elf: black
2022-12-09 16:07:46 +01:00
William Ballenthin
1583fedba2
mypy
2022-12-09 17:34:44 +01:00
William Ballenthin
307a6fad4f
elf: os: detect via so dependencies
2022-12-09 14:31:03 +01:00
William Ballenthin
958d5bcc6a
elf: refactor OS detection
2022-12-09 12:56:09 +01:00
William Ballenthin
c5a9aa21bf
wip: elf: better detect linux ELF files
2022-12-08 21:33:57 +01:00
Willi Ballenthin
b290690b19
Merge pull request #1216 from mandiant/fix/issue-1215
...
add missing vverbose feature renderers
2022-12-07 15:12:10 +01:00
Willi Ballenthin
a6fdb71178
utils: use a single hex() implementation
2022-12-07 14:09:37 +00:00
Willi Ballenthin
45d007fa9a
explorer: fix UnboundLocalError
...
closes #1217
2022-12-07 13:39:55 +00:00
Willi Ballenthin
662ec11031
explorer: accept only plaintext to rule window
...
closes #1194
2022-12-07 13:38:50 +00:00
Willi Ballenthin
1d8a3486cd
vverbose: prefer isinstance checks over strings
...
which also makes mypy happier
2022-12-07 13:14:05 +00:00
Willi Ballenthin
c195afa0b3
explorer: improve rendering of operand number/offsets
2022-12-07 13:07:24 +00:00
Willi Ballenthin
63e0d9b3f3
vverbose: render offer and operand number/offset features
...
closes #1215
2022-12-07 12:59:37 +00:00
Willi Ballenthin
659cbedc3c
vverbose: dont show offset for format
2022-12-07 12:59:21 +00:00
Willi Ballenthin
0ebba2cd15
vverbose: guard against rendering basic blocks
2022-12-07 12:58:55 +00:00
Willi Ballenthin
d1aafa3764
vverbose: render offset
...
closes #1215
2022-12-07 11:52:41 +00:00
Willi Ballenthin
473d0daf58
render: pylint
2022-12-07 11:41:05 +00:00
Willi Ballenthin
a10abfebde
main: pylint
2022-12-06 16:23:10 +00:00
Willi Ballenthin
78172b5f5b
rules: pylint
2022-12-06 16:06:08 +00:00
Willi Ballenthin
1caeb248ca
pylint: fix old-style super calls
2022-12-06 16:02:21 +00:00
Willi Ballenthin
8527d02dc8
pylint fixes
2022-12-06 15:37:31 +00:00
Mike Hunhoff
20c7949be3
dotnet: emit features from newobj instruction ( #1186 )
2022-10-13 08:35:29 -06:00
Willi Ballenthin
85b14075cd
address: explicitly resolve hash from int
2022-10-11 09:47:25 +00:00
Mike Hunhoff
e1735f0a5e
update pydantic models to guarantee type coercion ( #1176 )
...
* add CompoundStatement to fix Pydantic typing bug
* explorer: fix #1151
* explorer: support rendering operand number/offset
2022-09-20 08:38:19 -06:00
Mike Hunhoff
3c1cd67f60
dotnet: support property feature extraction ( #1168 )
2022-09-09 12:09:41 -06:00
