gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2026-07-28 14:47:08 -07:00
Code Issues Packages Projects Releases Wiki Activity
6,260 Commits 53 Branches 49 Tags
ee14b11fcdc2d89397f2fbf24586c7a63ad6334a
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Willi BallenthinandGitHub 2c12cbb485 tests: add data-driven test fixtures for rule matcher (#2987) 2026-06-11 13:42:29 +02:00
Willi BallenthinandGitHub 028aa533b1 tests: add more ELF OS detection cases (#3099) 
* tests: add more ELF OS detection cases
 2026-06-11 10:42:10 +02:00
Willi BallenthinandGitHub 8a18bd0e54 tests: add more granular ELF OS detection tests, data-driven (#3098) 
to better support ports of this logic to other languages/runtimes
 2026-06-11 10:18:14 +02:00
Willi BallenthinandGitHub ccf3a87e83 tests: add snapshot tests for feature extraction (#3069) 
Introduces data-driven snapshot tests that regenerate capa freeze files
for a curated set of samples in the tests/data submodule and compare the
bytes against committed fixtures under tests/fixtures/freezes/. Any
change that perturbs feature extraction surfaces as a test failure with
a feature-count delta and a truncated unified diff.
 2026-06-09 23:28:49 +02:00
Willi BallenthinandGitHub 0b1e3bfbdf cache: support *BSD (#2949) 
* cache: support *BSD

closes #2930 

thanks @res2500

* changelog
 2026-03-20 13:51:10 -06:00
Willi BallenthinandWilli Ballenthin c89871f257 ci: pin setup-uv 2026-01-13 16:15:31 +01:00
Willi BallenthinGitHubMoritz
 		cb2e2323f9 explorer: add support for IDA 9.2 (#2723) 
* ida: add Qt compatibility layer for PyQt5 and PySide6

Introduce a new module `qt_compat.py` providing a unified import
interface and API compatibility for Qt modules. It handles differences between
PyQt5 (used in IDA <9.2) and PySide6 (used in IDA >=9.2). Update all
plugin modules to import Qt components via this compatibility layer
instead of directly importing from PyQt5. This enhances plugin
compatibility across different IDA versions.

thanks @mike-hunhoff!

changelog

* qt_compat: use __all__ rather than noqa

---------

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
 2025-11-03 13:29:06 +01:00
Willi BallenthinandGitHub 5ea63770ba Merge pull request #2724 from HexRays-plugin-contributions/ida-plugin-json 
add `ida-plugin.json`
 2025-10-29 17:55:49 +01:00
Willi BallenthinandWilli Ballenthin c664dc662f changelog 2025-03-18 08:21:51 -06:00
Willi BallenthinandWilli Ballenthin c1c71613a9 cape: make some pe fields optional 
closes #2632

but, pe.imagebase is required, so keeping that (so test field will
continue to fail).
 2025-03-18 08:21:51 -06:00
Willi BallenthinandWilli Ballenthin fa90aae3dc cape: make behavior.summary optional 
closes #2631
 2025-03-18 08:21:51 -06:00
Willi BallenthinandWilli Ballenthin 618a5fa2e5 pyproject: remove pytest-cov 
closes #2491
 2025-01-29 18:54:42 +01:00
Willi BallenthinandWilli Ballenthin 990fd20757 update submodules 2025-01-29 02:25:06 -07:00
Willi BallenthinandWilli Ballenthin caae77dab6 vverbose: don't render full ppid/pid/tid in nested blocks, only callid 2025-01-29 02:25:06 -07:00
Willi BallenthinandWilli Ballenthin 4f844533c5 vverbose: don't use plural "calls" when there's a single call 2025-01-29 02:25:06 -07:00
Willi BallenthinandWilli Ballenthin 9a0c4f712d vverbose: fix rendering of span-of-calls summaries 
https://github.com/mandiant/capa/pull/2532#discussion_r1920711965

vverbose: fix collection of span-of-calls call match locations
 2025-01-29 02:25:06 -07:00
Willi BallenthinandWilli Ballenthin cdc1cb7afd rename "sequence" scope to "span of calls" scope 
pep8

fix ref

update submodules

update testfiles submodule

duplicate variable
 2025-01-29 02:25:06 -07:00
Willi BallenthinandWilli Ballenthin 277504c7b7 changelog: add sequence scope 2025-01-29 02:25:06 -07:00
Willi BallenthinandWilli Ballenthin a1d46bc3c0 sequence: don't update feature locations in place 
pep8
 2025-01-29 02:25:06 -07:00
Willi BallenthinandWilli Ballenthin e6bdcff5d9 sequence: better collect sequence-related addresses from Range statements 2025-01-29 02:25:06 -07:00
Willi BallenthinandWilli Ballenthin f55086c212 sequence: refactor into SequenceMatcher 
contains the call ids for all the calls within the sequence, so we know
where to look for related matched.

sequence: refactor SequenceMatcher

sequence: don't use sequence addresses

sequence: remove sequence address
 2025-01-29 02:25:06 -07:00
Willi BallenthinandWilli Ballenthin 39319c57a4 sequence: documentation and tests 
sequence: add more tests
 2025-01-29 02:25:06 -07:00
Willi BallenthinandWilli Ballenthin 86908c9025 sequence scope: optimize matching 2025-01-29 02:25:06 -07:00
Willi BallenthinandWilli Ballenthin 294ff34a30 sequence: only match first overlapping sequence 
also, for repeating behavior, match only the first instance.
 2025-01-29 02:25:06 -07:00
Willi BallenthinandWilli Ballenthin b06fea130c dynamic: add sequence scope 
addresses discussion in
https://github.com/mandiant/capa-rules/discussions/951

pep8

sequence: add test showing multiple sequences overlapping a single event
 2025-01-29 02:25:06 -07:00
Willi BallenthinandWilli Ballenthin 8d17319128 capabilities: use dataclasses to represent complicated return types 
foo
 2025-01-29 02:25:06 -07:00
Willi BallenthinandWilli Ballenthin 4896ff01d8 result: make copy of locations 
to ensure its not modified by reference after we expect it to be
 2025-01-29 02:25:06 -07:00
Willi BallenthinandWilli Ballenthin 8329abd3c8 rd: debugging helper formatting 2025-01-29 02:25:06 -07:00
Willi BallenthinandWilli Ballenthin 8c412f361a elffile: fix handling of symbols without a name 
closes #2553

elffile: fix key error
 2025-01-15 13:45:38 -07:00
Willi BallenthinandWilli Ballenthin 5c60adaf96 BinExport2: better handle weird Ghidra expressions 
analogous to the inspect-binexport2 issues reported in #2528 and #2530,
but this fixes the feature extractor.
 2024-12-09 11:27:11 +01:00
Willi BallenthinandWilli Ballenthin 4ab8d75629 changelog 2024-12-09 11:27:11 +01:00
Willi BallenthinandWilli Ballenthin 51d852d1b3 inspect-binexport: better handle MSRs exported by Ghidra 
closes #2530
 2024-12-09 11:27:11 +01:00
Willi BallenthinandWilli Ballenthin aa8e4603d1 inspect-binexport2: render aarch64 vector element sizes 
closes #2528
 2024-12-09 11:27:11 +01:00
Willi BallenthinandWilli Ballenthin 6c61a91778 main: use two lines when warning about stack trace 2024-12-09 11:27:11 +01:00
Willi BallenthinandWilli Ballenthin 9c72c9067b binexport2: better pruning of comma expressions with a single child 2024-12-06 07:19:39 +01:00
Willi BallenthinandWilli Ballenthin 168435cf75 changelog 2024-12-06 07:19:39 +01:00
Willi BallenthinandWilli Ballenthin 5fdf7e61e2 inspect-binexport2: better render ARM lsl/lsr and pruned expressions 2024-12-06 07:19:39 +01:00
Willi BallenthinandWilli Ballenthin 95fc747e6f binexport2: prune operands more precisely 2024-12-06 07:19:39 +01:00
Willi BallenthinandWilli Ballenthin 76a4a5899f test_scripts: avoid unsupported logic combinations 2024-06-07 05:54:49 +02:00
Willi BallenthinandWilli Ballenthin 4d81b7ab98 rules: add references to existing issues 2024-06-07 05:54:49 +02:00
Willi BallenthinandWilli Ballenthin b068890fa6 rules: match: optimize rule matching by better indexing rule by features 
Implement the "tighten rule pre-selection" algorithm described here:
https://github.com/mandiant/capa/issues/2063#issuecomment-2100498720

In summary:

> Rather than indexing all features from all rules,
> we should pick and index the minimal set (ideally, one) of
> features from each rule that must be present for the rule to match.
> When we have multiple candidates, pick the feature that is
> probably most uncommon and therefore "selective".

This seems to work pretty well. Total evaluations when running against
mimikatz drop from 19M to 1.1M (wow!) and capa seems to match around
3x more functions per second (wow wow).

When doing large scale runs, capa is about 25% faster when using the
vivisect backend (analysis heavy) or 3x faster when using the
upcoming BinExport2 backend (minimal analysis).
 2024-06-07 05:54:49 +02:00
Willi BallenthinandWilli Ballenthin b59df659c9 pep8 2024-05-08 16:20:10 +02:00
Willi BallenthinandWilli Ballenthin 519cfb842e profile-time: more result reporting, and learn to specify other backends 2024-05-08 16:20:10 +02:00
Willi BallenthinandWilli Ballenthin f26a109b4d pep8 2024-05-07 15:21:14 +02:00
Willi BallenthinandWilli Ballenthin d26897afca capabilities: don't show progress bar when stderr is redirected to a file 2024-05-07 15:21:14 +02:00
Willi BallenthinandWilli Ballenthin 6869ef6520 engine, common: use FeatureSet type annotation for evaluate signature 
It was used in some places already, but now used everywhere consistently.
This should make it easier to refactor the FeatureSet type, if necessary,
because its easier to see all the places its used.
 2024-05-07 15:20:50 +02:00
Willi BallenthinandWilli Ballenthin 4fbd2ba2b8 capabilities: fix duplicate name 2024-05-07 15:20:16 +02:00
Willi BallenthinandWilli Ballenthin 283ce41a5e capabilities: only log "real" matched rules, not derived count 2024-05-07 15:20:16 +02:00
Willi BallenthinandWilli Ballenthin 0f9dd9095b fmt 2024-02-14 15:57:24 +01:00
Willi BallenthinandWilli Ballenthin b163f82a71 changelog 2024-02-14 15:57:24 +01:00
Willi BallenthinandWilli Ballenthin bd3cc18a25 loader: avoid eager imports of some backend-related code 2024-02-14 15:57:24 +01:00
Willi BallenthinandWilli Ballenthin 4e2f175b9f rules: don't eagerly import ruamel until needed 2024-02-14 15:57:24 +01:00
Willi BallenthinandWilli Ballenthin fdd097a141 main: remove unused imports 2024-02-14 15:57:24 +01:00
Willi BallenthinandWilli Ballenthin 1b4e5258f8 elf: don't require vivisect just for type annotations 2024-02-14 15:57:24 +01:00
Willi BallenthinandWilli Ballenthin 9929967634 changelog 2024-01-31 14:16:23 +01:00
Willi BallenthinandWilli Ballenthin 3436aab3fd proto: regenerate pyi with same protoc 2024-01-31 14:16:23 +01:00
Willi Ballenthin 3c159a1f52 ci: revert temporary CI event subscription 2023-11-29 14:26:53 +00:00
Willi Ballenthin 9a996d07c7 Merge branch 'dynamic-feature-extraction' of public.github.com:mandiant/capa into dynamic-feature-extraction 2023-11-29 13:46:47 +00:00
Willi Ballenthin 93cfb6ef8c sync testfiles submodule 2023-11-29 13:46:29 +00:00
Willi Ballenthin 583f8b5688 Merge branch 'dynamic-feature-extraction' of public.github.com:mandiant/capa into dynamic-feature-extraction 2023-11-29 13:13:04 +00:00
Willi Ballenthin b4c6bf859e changelog 2023-11-29 13:12:30 +00:00
Willi Ballenthin a870c92a2f sync submodule rules 2023-11-15 11:00:51 +00:00
Willi Ballenthin de5f08871e sync submodule rules 2023-11-15 10:57:16 +00:00
Willi Ballenthin 987eb2d358 sync rules submodule 2023-11-14 14:34:08 +00:00
Willi Ballenthin 6e3fff4bae use latest rules migration 2023-11-14 14:29:34 +00:00
Willi Ballenthin 82013f0e24 submodule: tests: data: sync 2023-11-14 10:35:18 +00:00
Willi Ballenthin a52af3895a verbose: remove TODOs 2023-11-06 10:37:22 +00:00
Willi Ballenthin 5d31bc462b verbose: render dynamic match locations 2023-11-06 10:34:26 +00:00
Willi Ballenthin 7678897334 tests: fix render tests 2023-11-06 10:32:44 +00:00
Willi Ballenthin 75ff58edaa vverbose: better render pid/tid/call index 2023-11-06 10:09:23 +00:00
Willi Ballenthin eb12ec43f0 mypy 2023-11-06 09:52:00 +00:00
Willi Ballenthin f7c72cd1c3 vverbose: don't repeat rendered calls when in call scope 2023-11-06 09:52:00 +00:00
Willi Ballenthin 0da614aa4f vverbose: dynamic: show rendered matching API call 2023-11-06 09:52:00 +00:00
Willi Ballenthin 9c81ccf88a vverbose: make missing names an error 2023-11-06 09:52:00 +00:00
Willi Ballenthin c141f7ec6e verbose: better render scopes 2023-11-06 09:52:00 +00:00
Willi Ballenthin 274a710bb1 report: better compute dynamic layout 2023-11-06 09:52:00 +00:00
Willi Ballenthin 9e6919f33c layout: capture call names 
so that they can be rendered to output
 2023-10-20 14:21:13 +00:00
Willi Ballenthin 393b0e63f0 layout: capture process name 2023-10-20 12:39:28 +00:00
Willi Ballenthin ee4f02908c layout: capture process name 2023-10-20 12:38:35 +00:00
Willi Ballenthin 788251ba2b vverbose: render scope for humans 2023-10-20 11:37:42 +00:00
Willi Ballenthin 1143f2ba56 changelog 2023-10-20 07:11:42 +00:00
Willi Ballenthin 10dc4b92b1 freeze: update freeze format v3 2023-10-20 06:59:53 +00:00
Willi Ballenthin bfecf414fb freeze: add dynamic tests 2023-10-20 06:59:34 +00:00
Willi Ballenthin 0231ceef87 null extractor: fix typings 2023-10-20 06:59:16 +00:00
Willi Ballenthin c724a4b311 ci: only run BN and Ghidra tests after others complete 
these are much less likely to fail because they're
changed less often, so don't run them until we know
other tests also pass.
 2023-10-19 11:35:42 +00:00
Willi Ballenthin 84e22b187d doc 2023-10-19 11:29:30 +00:00
Willi Ballenthin b6a0d6e1f3 pre-commit: fix stages 2023-10-19 11:26:22 +00:00
Willi Ballenthin 1cb3ca61cd pre-commit: only run fast checks during commit 2023-10-19 10:35:57 +00:00
Willi Ballenthin 288313a300 changelog 2023-10-19 10:28:37 +00:00
Willi Ballenthin 2cc6a37713 ci: run fast tests before the full suite 2023-10-19 10:23:03 +00:00
Willi Ballenthin fbeb33a91f Merge branch 'dynamic-feature-extraction' into fix/dynamic-proto 2023-10-19 10:05:26 +00:00
Willi Ballenthin 3519125e03 tests: fix COM tests with dynamic scope 2023-10-19 10:04:26 +00:00
Willi Ballenthin 98360328f9 proto: fix serialization of call address 2023-10-19 09:59:18 +00:00
Willi Ballenthin 3d4facd9a3 Merge branch 'dynamic-feature-extraction' into fix/dynamic-proto 2023-10-19 09:24:37 +00:00
Willi Ballenthin 8b0ba1e656 tests: rename freeze tests 2023-10-19 09:24:18 +00:00
Willi Ballenthin 7bc3fba7b0 Merge branch 'dynamic-feature-extraction' into fix/dynamic-proto 2023-10-19 09:20:15 +00:00
Willi Ballenthin d5e187bc70 Merge branch 'master' into dynamic-feature-extraction 2023-10-19 09:15:57 +00:00
Willi Ballenthin 21f9e0736d isort 2023-10-17 15:07:34 +00:00
Willi Ballenthin 55e4fddc51 mypy 2023-10-17 14:46:33 +00:00
Willi Ballenthin 1aac4a1a69 mypy 2023-10-17 14:42:58 +00:00