358 Commits

Author	SHA1	Message	Date
Mike Hunhoff	24c4215820	dotnet: add file string parsing (#1012)	2022-05-05 13:39:29 -06:00
Mike Hunhoff	580a2d7e45	dotnet: basic detection and feature extraction (#987)	2022-04-08 14:55:00 -06:00
Capa Bot	5bc44aef0f	Sync capa-testfiles submodule	2022-04-08 10:34:02 +00:00
Willi Ballenthin	8a2276f398	smda: implement operand number/offset features ... cause its not too hard	2022-04-07 12:48:25 -06:00
Willi Ballenthin	1c7b6bcf7d	fixtures: use function that IDA doesn't recognize as lib func	2022-04-06 15:07:35 -06:00
Willi Ballenthin	b843cef986	tests: add tests for #320	2022-04-06 14:38:56 -06:00
Willi Ballenthin	0e95691cde	tests: fixtures: enable assertions against instruction scope	2022-04-06 14:38:33 -06:00
Willi Ballenthin	55a5d10859	Merge pull request #961 from mandiant/feature-remove-flavors ... remove /x32 and /x64 flavors of number and offset features	2022-04-06 12:57:18 -06:00
Capa Bot	633d8df1a4	Sync capa-testfiles submodule	2022-04-06 17:21:09 +00:00
Willi Ballenthin	aee61b35e4	*: remove more references to /x32 and /x64	2022-04-05 10:41:03 -06:00
Willi Ballenthin	ecabd557a7	*: remove /x32 and /x64 flavors from number and offset features	2022-04-05 10:35:41 -06:00
Willi Ballenthin	ef93fcc89e	tests: smda: xfail operand number/offset features	2022-04-04 12:05:15 -06:00
Willi Ballenthin	9da4ff10da	*: rename OperandImmediate to OperandNumber	2022-03-31 10:37:06 -06:00
Willi Ballenthin	997daf537e	viv: insn: extract OperandOffset and OperandImmediate	2022-03-30 13:14:08 -06:00
Willi Ballenthin	c7aadca25c	tests: demonstrate OperandOffset and OperandImmediate	2022-03-30 13:13:50 -06:00
Willi Ballenthin	49adb8de0c	pep8	2022-03-29 13:00:28 -06:00
Willi Ballenthin	fb6b60bee3	tests: add tests demonstrating instruction (sub)scope matching	2022-03-29 12:58:38 -06:00
Willi Ballenthin	7487da89a1	Merge branch 'master' into feature-insn-scope	2022-03-29 11:51:14 -06:00
Willi Ballenthin	dde52f2bc8	pep8	2022-03-28 13:04:44 -06:00
Willi Ballenthin	46cc681eba	tests: demonstrate instruct subscope rule extraction	2022-03-28 13:04:13 -06:00
Willi Ballenthin	2baf05acdb	rules: parse instruction subscope with implied AND	2022-03-28 12:55:09 -06:00
Willi Ballenthin	9da9c3aceb	rules: add valid features for insn scope	2022-03-28 12:40:10 -06:00
Capa Bot	ecea572192	Sync capa-testfiles submodule	2022-03-24 09:30:26 +00:00
Capa Bot	1cd5e89f85	Sync capa-testfiles submodule	2022-03-22 07:22:11 +00:00
Capa Bot	cbf9f321c6	Sync capa-testfiles submodule	2022-03-14 10:18:05 +00:00
Baptistin Boilot	4d915020a8	extractor: add characteristic(call $+5) feature extraction for vivisect and smda	2022-02-27 18:15:25 +01:00
Capa Bot	f0fc39e1d0	Sync capa-testfiles submodule	2022-01-24 13:37:25 +00:00
Capa Bot	81d604d85a	Sync capa-testfiles submodule	2022-01-24 11:00:44 +00:00
Baptistin Boilot	8474369575	tests: add fixtures for two's complement numbers ... Add fixtures to validate the following number features: - number(0x0): to check feature extraction for null number - number(0xFFFFFFFF): to check feature extraction for -1 number - number(0xFFFFFFF0): to check feature extraction for negative number (-0x10 in this case)	2021-12-31 20:08:56 +01:00
Capa Bot	90430f52c6	Sync capa-testfiles submodule	2021-12-15 15:33:39 +00:00
Capa Bot	cc8d57b242	Sync capa-testfiles submodule	2021-12-13 17:24:52 +00:00
Capa Bot	6081f4573c	Sync capa-testfiles submodule	2021-12-13 17:24:32 +00:00
Capa Bot	ea2cafa715	Sync capa-testfiles submodule	2021-12-13 17:24:02 +00:00
Capa Bot	09fd371b9d	Sync capa-testfiles submodule	2021-12-06 10:13:41 +00:00
Capa Bot	a598745938	Sync capa-testfiles submodule	2021-12-06 10:06:57 +00:00
Capa Bot	7751f693c8	Sync capa-testfiles submodule	2021-12-06 10:02:45 +00:00
Capa Bot	7ade9ca43e	Sync capa-testfiles submodule	2021-12-06 10:01:17 +00:00
Capa Bot	c3d34abe89	Sync capa-testfiles submodule	2021-12-03 12:12:30 +00:00
Capa Bot	baf5005998	Sync capa-testfiles submodule	2021-12-03 12:12:20 +00:00
Capa Bot	de017b15d0	Sync capa-testfiles submodule	2021-11-30 15:24:09 +00:00
William Ballenthin	2d68fb2536	pep8	2021-11-10 12:51:27 -07:00
William Ballenthin	845df282ef	tests: split out match tests and validate alternative algorithms	2021-11-10 12:44:58 -07:00
William Ballenthin	ea386d02b6	tests: add test demonstrating optimizer	2021-11-09 16:24:26 -07:00
William Ballenthin	3e74da96a6	engine: make short circuiting configurable	2021-11-08 14:55:11 -07:00
William Ballenthin	9fa9c6a5d0	tests: add test demonstrating short circuiting	2021-11-08 14:07:44 -07:00
Capa Bot	02bd8581d8	Sync capa-testfiles submodule	2021-11-02 16:42:40 +00:00
William Ballenthin	b1f4a2853e	Merge branch 'master' of github.com:fireeye/capa into fix-802	2021-10-27 09:25:29 -06:00
William Ballenthin	07412f047d	tests: fix check of status code E_MISSING_FILE	2021-10-27 09:24:22 -06:00
William Ballenthin	31ef06ef2b	sync testfiles	2021-10-26 15:26:18 -06:00
William Ballenthin	4451b76f89	pep8	2021-10-26 15:21:28 -06:00