Willi Ballenthin and Willi Ballenthin
723ee16ef7
fix: omit trailing ' -> ' suffix in syscall call names when no return value
...
DrakvufExtractor.get_call_name always appended ' -> ' even for SystemCall
objects that have no return_value attribute, because f" -> {''}" still
produces the literal ' -> ' string. Conditionally build the suffix only
when a non-empty return value exists.
2026-05-08 17:58:07 +02:00
Willi Ballenthin and Willi Ballenthin
1f3a52eea7
fix: assign ConfigDict to model_config in ConciseModel so extra="ignore" is applied
...
ConciseModel called ConfigDict(extra="ignore") as a bare expression, discarding the result.
model_config was never set, so the extra="ignore" config was never in effect for any subclass.
Assign the result to model_config as intended.
2026-05-08 17:58:07 +02:00
7b23834d8e
build(deps-dev): bump black from 25.12.0 to 26.3.0 ( #2902 )
...
* build(deps-dev): bump black from 25.12.0 to 26.3.0
Bumps [black](https://github.com/psf/black ) from 25.12.0 to 26.3.0.
- [Release notes](https://github.com/psf/black/releases )
- [Changelog](https://github.com/psf/black/blob/main/CHANGES.md )
- [Commits](https://github.com/psf/black/compare/25.12.0...26.3.0 )
---
updated-dependencies:
- dependency-name: black
dependency-version: 26.3.0
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
* style: auto-format with black and isort
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Moritz <mr-tz@users.noreply.github.com >
Co-authored-by: Capa Bot <capa-dev@mandiant.com >
2026-03-13 15:46:13 +01:00
Ana Maria Martinez Gomez and Willi Ballenthin
3cd97ae9f2
[copyright + license] Fix headers
...
Replace the header from source code files using the following script:
```Python
for dir_path, dir_names, file_names in os.walk("capa"):
for file_name in file_names:
# header are only in `.py` and `.toml` files
if file_name[-3:] not in (".py", "oml"):
continue
file_path = f"{dir_path}/{file_name}"
f = open(file_path, "rb+")
content = f.read()
m = re.search(OLD_HEADER, content)
if not m:
continue
print(f"{file_path}: {m.group('year')}")
content = content.replace(m.group(0), NEW_HEADER % m.group("year"))
f.seek(0)
f.write(content)
```
Some files had the copyright headers inside a `"""` comment and needed
manual changes before applying the script. `hook-vivisect.py` and
`pyinstaller.spec` didn't include the license in the header and also
needed manual changes.
The old header had the confusing sentence `All rights reserved`, which
does not make sense for an open source license. Replace the header by
the default Google header that corrects this issue and keep capa
consistent with other Google projects.
Adapt the linter to work with the new header.
Replace also the copyright text in the `web/public/index.html` file for
consistency.
2025-01-15 08:52:42 -07:00
cf3494d427
Add a Feature Extractor for the Drakvuf Sandbox ( #2143 )
...
* initial commit
* update changelog
* Update CHANGELOG.md
* Update pyproject.toml
* Apply suggestions from code review: Typos
Co-authored-by: Vasco Schiavo <115561717+VascoSch92@users.noreply.github.com >
* capa/helpers.py: update if/else statement
Co-authored-by: Vasco Schiavo <115561717+VascoSch92@users.noreply.github.com >
* loader.py: replace print() statement with log.info()
* Update capa/features/extractors/drakvuf/models.py
Co-authored-by: Moritz <mr-tz@users.noreply.github.com >
* extractors/drakvuf/call.py: yield arguments right to left
* extractors/drakvuf/file.py: add a TODO comment for extracting more file features
* extractors/drakvuf/global_.py: add arch extraction
* extractors/drakvuf/helpers.py: ignore null pids
* capa/helpers.py: mention msgspec.json explicitely
* capa/helpers.py: generalize empty sandbox reports error logging
* capa/loader.py: log jsonl garbage collection into debug
* features/extractors/drakvuf/models.py: add documentation for SystemCall class
* capa/main.py: fix erroneous imports
* drakvuf extractor: fixed faulty type annotations
* fix black formatting
* fix flake8 issues
* drakvuf file extraction: add link to tracking issue
* drakvuf reports: add the ability to read gzip-compressed report files
* capa/helpers.py: fix mypy issues
* apply review comments
* drakvuf/helpers.py: add more information about null pid
* drakvuf/file.py: remove discovered_dlls file strings extraction
* capa/helpers.py: add comments for the dynamic extensions
* capa/helpers.py: log bad lines
* capa/helpers.py: add gzip support for reading one jsonl line
* drakvuf/helpers.py: add comment for sort_calls()
* tests/fixtures.py: add TODO for unifying CAPE and Drakvuf tests
* drakvuf/models.py: add TODO comment for supporting more drakvuf plugins
* tests/fixtures.py: remove obsolete file strings tests
* Update capa/main.py
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* Update capa/features/extractors/drakvuf/models.py
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* Update capa/features/extractors/drakvuf/models.py
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* Update capa/features/extractors/drakvuf/call.py
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* Update CHANGELOG.md
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* Update capa/features/extractors/drakvuf/helpers.py
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* review comments
* Update capa/features/extractors/drakvuf/extractor.py
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* Update capa/features/extractors/drakvuf/models.py
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* styling
* drakvuf/extractor.py: black linting
* drakvuf/models.py: remove need to empty report checking
* tests: add drakvuf models test
* Update capa/features/extractors/drakvuf/global_.py
Co-authored-by: msm-cert <156842376+msm-cert@users.noreply.github.com >
* Update tests/test_cape_features.py
Co-authored-by: msm-cert <156842376+msm-cert@users.noreply.github.com >
* Update capa/features/extractors/drakvuf/models.py
Co-authored-by: msm-cert <156842376+msm-cert@users.noreply.github.com >
* Apply suggestions from code review: rename Drakvuf to DRAKVUF
Co-authored-by: msm-cert <156842376+msm-cert@users.noreply.github.com >
* drakvuf/call.py: use int(..., 0) instead of str_to_number()
* remove str_to_number
* drakvuf/call.py: yield argument memory address value as well
* Update call.py: remove verbosity in yield statement
* Update call.py: yield missing address as well
* drakvuf/call.py: yield entire argument string only
* update readme.md
* Update README.md: typo
* Update CHANGELOG.md
Co-authored-by: msm-cert <156842376+msm-cert@users.noreply.github.com >
---------
Co-authored-by: Vasco Schiavo <115561717+VascoSch92@users.noreply.github.com >
Co-authored-by: Moritz <mr-tz@users.noreply.github.com >
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
Co-authored-by: msm-cert <156842376+msm-cert@users.noreply.github.com >
2024-07-24 14:22:21 +02:00
