show-mdmp: print complete memory map when its available

show-mdmp: add 64-bit support
scripts: add script to show layout of minidump file
2026-03-15 06:18:57 -07:00 · 2023-07-19 17:12:14 +02:00 · 2023-07-19 16:45:20 +02:00 · 2023-07-19 15:41:29 +02:00
132 changed files with 2102 additions and 10246 deletions
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -41,7 +41,7 @@
 	// "forwardPorts": [],

 	// Use 'postCreateCommand' to run commands after the container is created.
-	"postCreateCommand": "git submodule update --init && pip3 install --user -e .[dev] && pre-commit install",
+	"postCreateCommand": "git submodule update --init && pip3 install --user -e .[dev]",

 	// Comment out to connect as root instead. More info: https://aka.ms/vscode-remote/containers/non-root.
 	"remoteUser": "vscode",
--- a/.github/mypy/mypy.ini
+++ b/.github/mypy/mypy.ini
@@ -86,6 +86,3 @@ ignore_missing_imports = True

 [mypy-netnode.*]
 ignore_missing_imports = True
-
-[mypy-ghidra.*]
-ignore_missing_imports = True
--- a/.github/pyinstaller/pyinstaller.spec
+++ b/.github/pyinstaller/pyinstaller.spec
@@ -17,7 +17,6 @@ a = Analysis(
        # when invoking pyinstaller from the project root,
        # this gets invoked from the directory of the spec file,
        # i.e. ./.github/pyinstaller
-        ("../../assets", "assets"),
        ("../../rules", "rules"),
        ("../../sigs", "sigs"),
        ("../../cache", "cache"),
@@ -80,7 +79,7 @@ exe = EXE(
    name="capa",
    icon="logo.ico",
    debug=False,
-    strip=False,
+    strip=None,
    upx=True,
    console=True,
 )
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -11,41 +11,34 @@ permissions:

 jobs:
  build:
-    name: PyInstaller for ${{ matrix.os }} / Py ${{ matrix.python_version }}
+    name: PyInstaller for ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      # set to false for debugging
      fail-fast: true
      matrix:
-        # using Python 3.8 to support running across multiple operating systems including Windows 7
        include:
          - os: ubuntu-20.04
            # use old linux so that the shared library versioning is more portable
            artifact_name: capa
            asset_name: linux
-            python_version: 3.8
-          - os: ubuntu-20.04
-            artifact_name: capa
-            asset_name: linux-py311
-            python_version: 3.11
          - os: windows-2019
            artifact_name: capa.exe
            asset_name: windows
-            python_version: 3.8
          - os: macos-11
            # use older macOS for assumed better portability
            artifact_name: capa
            asset_name: macos
-            python_version: 3.8
    steps:
      - name: Checkout capa
        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
        with:
          submodules: true
-      - name: Set up Python ${{ matrix.python_version }}
+      # using Python 3.8 to support running across multiple operating systems including Windows 7
+      - name: Set up Python 3.8
        uses: actions/setup-python@d27e3f3d7c64b4bbf8e4abfb9b63b83e846e0435 # v4.5.0
        with:
-          python-version: ${{ matrix.python_version }}
+          python-version: 3.8
      - if: matrix.os == 'ubuntu-20.04'
        run: sudo apt-get install -y libyaml-dev
      - name: Upgrade pip, setuptools
@@ -62,17 +55,13 @@ jobs:
        run: dist/capa "tests/data/499c2a85f6e8142c3f48d4251c9c7cd6.raw32"
      - name: Does it run (ELF)?
        run: dist/capa "tests/data/7351f8a40c5450557b24622417fc478d.elf_"
-      - name: Does it run (CAPE)?
-        run: |
-          7z e "tests/data/dynamic/cape/v2.2/d46900384c78863420fb3e297d0a2f743cd2b6b3f7f82bf64059a168e07aceb7.json.gz"
-          dist/capa "d46900384c78863420fb3e297d0a2f743cd2b6b3f7f82bf64059a168e07aceb7.json"
      - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
        with:
          name: ${{ matrix.asset_name }}
          path: dist/${{ matrix.artifact_name }}

  test_run:
-    name: Test run on ${{ matrix.os }} / ${{ matrix.asset_name }}
+    name: Test run on ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    needs: [build]
    strategy:
@@ -82,9 +71,6 @@ jobs:
          - os: ubuntu-22.04
            artifact_name: capa
            asset_name: linux
-          - os: ubuntu-22.04
-            artifact_name: capa
-            asset_name: linux-py311
          - os: windows-2022
            artifact_name: capa.exe
            asset_name: windows
@@ -110,8 +96,6 @@ jobs:
        include:
          - asset_name: linux
            artifact_name: capa
-          - asset_name: linux-py311
-            artifact_name: capa
          - asset_name: windows
            artifact_name: capa.exe
          - asset_name: macos
--- a/.github/workflows/pip-audit.yml
+++ b/.github/workflows/pip-audit.yml
@@ -1,21 +0,0 @@
-name: PIP audit
-
-on:
-  schedule:
-  - cron: '0 8 * * 1'
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    strategy:
-      matrix:
-        python-version: ["3.11"]
-
-    steps:
-      - name: Check out repository code
-        uses: actions/checkout@v4
-
-      - uses: pypa/gh-action-pip-audit@v1.0.8
-        with:
-          inputs: .
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -39,13 +39,13 @@ jobs:
    - name: Lint with ruff
      run: pre-commit run ruff
    - name: Lint with isort
-      run: pre-commit run isort --show-diff-on-failure
+      run: pre-commit run isort
    - name: Lint with black
-      run: pre-commit run black --show-diff-on-failure
+      run: pre-commit run black
    - name: Lint with flake8
-      run: pre-commit run flake8 --hook-stage manual
+      run: pre-commit run flake8
    - name: Check types with mypy
-      run:  pre-commit run mypy --hook-stage manual
+      run:  pre-commit run mypy

  rule_linter:
    runs-on: ubuntu-20.04
@@ -95,10 +95,6 @@ jobs:
      run: sudo apt-get install -y libyaml-dev
    - name: Install capa
      run: pip install -e .[dev]
-    - name: Run tests (fast)
-      # this set of tests runs about 80% of the cases in 20% of the time,
-      # and should catch most errors quickly.
-      run:  pre-commit run pytest-fast --all-files --hook-stage manual
    - name: Run tests
      run: pytest -v tests/

@@ -107,7 +103,7 @@ jobs:
    env:
      BN_SERIAL: ${{ secrets.BN_SERIAL }}
    runs-on: ubuntu-20.04
-    needs: [tests]
+    needs: [code_style, rule_linter]
    strategy:
      fail-fast: false
      matrix:
@@ -143,62 +139,3 @@ jobs:
      env:
        BN_LICENSE: ${{ secrets.BN_LICENSE }}
      run: pytest -v tests/test_binja_features.py  # explicitly refer to the binja tests for performance. other tests run above.
-
-  ghidra-tests:
-    name: Ghidra tests for ${{ matrix.python-version }}
-    runs-on: ubuntu-20.04
-    needs: [tests]
-    strategy:
-      fail-fast: false
-      matrix:
-        python-version: ["3.8", "3.11"]
-        java-version: ["17"]
-        gradle-version: ["7.3"]
-        ghidra-version: ["10.3"]
-        public-version: ["PUBLIC_20230510"] # for ghidra releases
-        jep-version: ["4.1.1"]
-        ghidrathon-version: ["3.0.0"]
-    steps:
-    - name: Checkout capa with submodules
-      uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
-      with:
-        submodules: true
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@d27e3f3d7c64b4bbf8e4abfb9b63b83e846e0435 # v4.5.0
-      with:
-        python-version: ${{ matrix.python-version }}
-    - name: Set up Java ${{ matrix.java-version }}
-      uses: actions/setup-java@5ffc13f4174014e2d4d4572b3d74c3fa61aeb2c2 # v3
-      with:
-        distribution: 'temurin'
-        java-version: ${{ matrix.java-version }}
-    - name: Set up Gradle ${{ matrix.gradle-version }} 
-      uses: gradle/gradle-build-action@40b6781dcdec2762ad36556682ac74e31030cfe2 # v2.5.1
-      with:
-        gradle-version: ${{ matrix.gradle-version }}
-    - name: Install Jep ${{ matrix.jep-version }} 
-      run : pip install jep==${{ matrix.jep-version }}
-    - name: Install Ghidra ${{ matrix.ghidra-version }} 
-      run: |
-        mkdir ./.github/ghidra
-        wget "https://github.com/NationalSecurityAgency/ghidra/releases/download/Ghidra_${{ matrix.ghidra-version }}_build/ghidra_${{ matrix.ghidra-version }}_${{ matrix.public-version }}.zip" -O ./.github/ghidra/ghidra_${{ matrix.ghidra-version }}_PUBLIC.zip
-        unzip .github/ghidra/ghidra_${{ matrix.ghidra-version }}_PUBLIC.zip -d .github/ghidra/
-    - name: Install Ghidrathon
-      run : |
-        mkdir ./.github/ghidrathon
-        curl -o ./.github/ghidrathon/ghidrathon-${{ matrix.ghidrathon-version }}.zip "https://codeload.github.com/mandiant/Ghidrathon/zip/refs/tags/v${{ matrix.ghidrathon-version }}"
-        unzip .github/ghidrathon/ghidrathon-${{ matrix.ghidrathon-version }}.zip -d .github/ghidrathon/
-        gradle -p ./.github/ghidrathon/Ghidrathon-${{ matrix.ghidrathon-version }}/ -PGHIDRA_INSTALL_DIR=$(pwd)/.github/ghidra/ghidra_${{ matrix.ghidra-version }}_PUBLIC
-        unzip .github/ghidrathon/Ghidrathon-${{ matrix.ghidrathon-version }}/dist/*.zip -d .github/ghidra/ghidra_${{ matrix.ghidra-version }}_PUBLIC/Ghidra/Extensions
-    - name: Install pyyaml
-      run: sudo apt-get install -y libyaml-dev
-    - name: Install capa
-      run: pip install -e .[dev] 
-    - name: Run tests
-      run: | 
-        mkdir ./.github/ghidra/project
-        .github/ghidra/ghidra_${{ matrix.ghidra-version }}_PUBLIC/support/analyzeHeadless .github/ghidra/project ghidra_test -Import ./tests/data/mimikatz.exe_ -ScriptPath ./tests/ -PostScript test_ghidra_features.py > ../output.log
-        cat ../output.log
-        exit_code=$(cat ../output.log | grep exit | awk '{print $NF}')
-        exit $exit_code
- 
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,8 +1,6 @@
 [submodule "rules"]
 	path = rules
 	url = ../capa-rules.git
-	branch = dynamic-syntax
 [submodule "tests/data"]
 	path = tests/data
 	url = ../capa-testfiles.git
-	branch = dynamic-feature-extractor
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -25,7 +25,7 @@ repos:
    hooks:
    -   id: isort
        name: isort
-        stages: [commit, push, manual]
+        stages: [commit, push]
        language: system
        entry: isort
        args: 
@@ -45,7 +45,7 @@ repos:
    hooks:
    -   id: black
        name: black
-        stages: [commit, push, manual]
+        stages: [commit, push]
        language: system
        entry: black
        args: 
@@ -62,7 +62,7 @@ repos:
    hooks:
    -   id: ruff
        name: ruff
-        stages: [commit, push, manual]
+        stages: [commit, push]
        language: system
        entry: ruff
        args: 
@@ -79,7 +79,7 @@ repos:
    hooks:
    -   id: flake8
        name: flake8
-        stages: [push, manual]
+        stages: [commit, push]
        language: system
        entry: flake8
        args: 
@@ -97,7 +97,7 @@ repos:
    hooks:
    -   id: mypy
        name: mypy
-        stages: [push, manual]
+        stages: [commit, push]
        language: system
        entry: mypy
        args: 
@@ -109,21 +109,3 @@ repos:
        -   "tests/"
        always_run: true
        pass_filenames: false
-
-   repo: local
-    hooks:
-    -   id: pytest-fast
-        name: pytest (fast)
-        stages: [manual]
-        language: system
-        entry: pytest
-        args: 
-        -   "tests/"
-        -   "--ignore=tests/test_binja_features.py"
-        -   "--ignore=tests/test_ghidra_features.py"
-        -   "--ignore=tests/test_ida_features.py"
-        -   "--ignore=tests/test_viv_features.py"
-        -   "--ignore=tests/test_main.py"
-        -   "--ignore=tests/test_scripts.py"
-        always_run: true
-        pass_filenames: false
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,116 +3,22 @@
 ## master (unreleased)

 ### New Features
- add Ghidra backend #1770 #1767 @colton-gabertan @mike-hunhoff
- add dynamic analysis via CAPE sandbox reports #48 #1535 @yelhamer
-  - add call scope #771 @yelhamer
-  - add thread scope #1517 @yelhamer
-  - add process scope #1517 @yelhamer
-  - rules: change `meta.scope` to `meta.scopes` @yelhamer
-  - protobuf: add `Metadata.flavor` @williballenthin
- binja: add support for forwarded exports #1646 @xusheng6
- binja: add support for symtab names #1504 @xusheng6
- add com class/interface features #322 @Aayush-goel-04

 ### Breaking Changes

- remove the `SCOPE_*` constants in favor of the `Scope` enum #1764 @williballenthin
- protobuf: deprecate `RuleMetadata.scope` in favor of `RuleMetadata.scopes` @williballenthin
- protobuf: deprecate `Metadata.analysis` in favor of `Metadata.analysis2` that is dynamic analysis aware @williballenthin
- update freeze format to v3, adding support for dynamic analysis @williballenthin
- extractor: ignore DLL name for api features #1815 @mr-tz
+### New Rules (0)

-### New Rules (34)
-
- nursery/get-ntoskrnl-base-address @mr-tz
- host-interaction/network/connectivity/set-tcp-connection-state @johnk3r
- nursery/capture-process-snapshot-data @mr-tz
- collection/network/capture-packets-using-sharppcap jakub.jozwiak@mandiant.com
- nursery/communicate-with-kernel-module-via-netlink-socket-on-linux michael.hunhoff@mandiant.com
- nursery/get-current-pid-on-linux michael.hunhoff@mandiant.com
- nursery/get-file-system-information-on-linux michael.hunhoff@mandiant.com
- nursery/get-password-database-entry-on-linux michael.hunhoff@mandiant.com
- nursery/mark-thread-detached-on-linux michael.hunhoff@mandiant.com
- nursery/persist-via-gnome-autostart-on-linux michael.hunhoff@mandiant.com
- nursery/set-thread-name-on-linux michael.hunhoff@mandiant.com
- load-code/dotnet/load-windows-common-language-runtime michael.hunhoff@mandiant.com blas.kojusner@mandiant.com jakub.jozwiak@mandiant.com
- nursery/log-keystrokes-via-input-method-manager @mr-tz
- nursery/encrypt-data-using-rc4-via-systemfunction032 richard.weiss@mandiant.com
- nursery/add-value-to-global-atom-table @mr-tz
- nursery/enumerate-processes-that-use-resource @Ana06
- host-interaction/process/inject/allocate-or-change-rwx-memory @mr-tz
- lib/allocate-or-change-rw-memory 0x534a@mailbox.org @mr-tz
- lib/change-memory-protection @mr-tz
- anti-analysis/anti-av/patch-antimalware-scan-interface-function jakub.jozwiak@mandiant.com
- executable/dotnet-singlefile/bundled-with-dotnet-single-file-deployment sara.rincon@mandiant.com
- internal/limitation/file/internal-dotnet-single-file-deployment-limitation sara.rincon@mandiant.com
- data-manipulation/encoding/encode-data-using-add-xor-sub-operations jakub.jozwiak@mandiant.com
- nursery/access-camera-in-dotnet-on-android michael.hunhoff@mandiant.com
- nursery/capture-microphone-audio-in-dotnet-on-android michael.hunhoff@mandiant.com
- nursery/capture-screenshot-in-dotnet-on-android michael.hunhoff@mandiant.com
- nursery/check-for-incoming-call-in-dotnet-on-android michael.hunhoff@mandiant.com
- nursery/check-for-outgoing-call-in-dotnet-on-android michael.hunhoff@mandiant.com
- nursery/compiled-with-xamarin michael.hunhoff@mandiant.com
- nursery/get-os-version-in-dotnet-on-android michael.hunhoff@mandiant.com
- data-manipulation/compression/create-cabinet-on-windows michael.hunhoff@mandiant.com jakub.jozwiak@mandiant.com
- data-manipulation/compression/extract-cabinet-on-windows jakub.jozwiak@mandiant.com
- lib/create-file-decompression-interface-context-on-windows jakub.jozwiak@mandiant.com
 -

 ### Bug Fixes
- ghidra: fix `ints_to_bytes` performance #1761 @mike-hunhoff
- binja: improve function call site detection @xusheng6
- binja: use `binaryninja.load` to open files @xusheng6
- binja: bump binja version to 3.5 #1789 @xusheng6

 ### capa explorer IDA Pro plugin

 ### Development

 ### Raw diffs
- [capa v6.1.0...master](https://github.com/mandiant/capa/compare/v6.1.0...master)
- [capa-rules v6.1.0...master](https://github.com/mandiant/capa-rules/compare/v6.1.0...master)
-
-## v6.1.0
-
-capa v6.1.0 is a bug fix release, most notably fixing unhandled exceptions in the capa explorer IDA Pro plugin.
-@Aayush-Goel-04 put a lot of effort into improving code quality and adding a script for rule authors.
-The script shows which features are present in a sample but not referenced by any existing rule.
-You could use this script to find opportunities for new rules.
-
-Speaking of new rules, we have eight additions, coming from Ronnie, Jakub, Moritz, Ervin, and still@teamt5.org!
-
-### New Features
- ELF: implement import and export name extractor #1607 #1608 @Aayush-Goel-04
- bump pydantic from 1.10.9 to 2.1.1 #1582 @Aayush-Goel-04
- develop script to highlight features not used during matching #331 @Aayush-Goel-04
-
-### New Rules (8)
-
- executable/pe/export/forwarded-export ronnie.salomonsen@mandiant.com
- host-interaction/bootloader/get-uefi-variable jakub.jozwiak@mandiant.com
- host-interaction/bootloader/set-uefi-variable jakub.jozwiak@mandiant.com
- nursery/enumerate-device-drivers-on-linux @mr-tz
- anti-analysis/anti-vm/vm-detection/check-for-foreground-window-switch ervin.ocampo@mandiant.com
- linking/static/sqlite3/linked-against-cppsqlite3 still@teamt5.org
- linking/static/sqlite3/linked-against-sqlite3 still@teamt5.org
-
-### Bug Fixes
-
- rules: fix forwarded export characteristic #1656 @RonnieSalomonsen
- Binary Ninja: Fix stack string detection #1473 @xusheng6
- linter: skip native API check for NtProtectVirtualMemory #1675 @williballenthin 
- OS: detect Android ELF files #1705 @williballenthin
- ELF: fix parsing of symtab #1704 @williballenthin
- result document: don't use deprecated pydantic functions #1718 @williballenthin
- pytest: don't mark IDA tests as pytest tests #1719 @williballenthin
-
-### capa explorer IDA Pro plugin
- fix unhandled exception when resolving rule path #1693 @mike-hunhoff
-
-### Raw diffs
- [capa v6.0.0...v6.1.0](https://github.com/mandiant/capa/compare/v6.0.0...v6.1.0)
- [capa-rules v6.0.0...v6.1.0](https://github.com/mandiant/capa-rules/compare/v6.0.0...v6.1.0)
+- [capa v6.0.0...master](https://github.com/mandiant/capa/compare/v6.0.0...master)
+- [capa-rules v6.0.0...master](https://github.com/mandiant/capa-rules/compare/v6.0.0...master)

 ## v6.0.0

@@ -176,7 +82,6 @@ For those that use capa as a library, we've introduced some limited breaking cha
 - output: don't leave behind traces of progress bar @williballenthin
 - import-to-ida: fix bug introduced with JSON report changes in v5 #1584 @williballenthin
 - main: don't show spinner when emitting debug messages #1636 @williballenthin
- rules: add forwarded export characteristics to rule syntax file scope #1653 @RonnieSalomonsen

 ### capa explorer IDA Pro plugin

@@ -1626,4 +1531,4 @@ Download a standalone binary below and checkout the readme [here on GitHub](http
 ### Raw diffs

  - [capa v1.0.0...v1.1.0](https://github.com/mandiant/capa/compare/v1.0.0...v1.1.0)
-  - [capa-rules v1.0.0...v1.1.0](https://github.com/mandiant/capa-rules/compare/v1.0.0...v1.1.0)
+  - [capa-rules v1.0.0...v1.1.0](https://github.com/mandiant/capa-rules/compare/v1.0.0...v1.1.0)
--- a/README.md
+++ b/README.md
@@ -2,13 +2,13 @@

 [![PyPI - Python Version](https://img.shields.io/pypi/pyversions/flare-capa)](https://pypi.org/project/flare-capa)
 [![Last release](https://img.shields.io/github/v/release/mandiant/capa)](https://github.com/mandiant/capa/releases)
-[![Number of rules](https://img.shields.io/badge/rules-859-blue.svg)](https://github.com/mandiant/capa-rules)
+[![Number of rules](https://img.shields.io/badge/rules-823-blue.svg)](https://github.com/mandiant/capa-rules)
 [![CI status](https://github.com/mandiant/capa/workflows/CI/badge.svg)](https://github.com/mandiant/capa/actions?query=workflow%3ACI+event%3Apush+branch%3Amaster)
 [![Downloads](https://img.shields.io/github/downloads/mandiant/capa/total)](https://github.com/mandiant/capa/releases)
 [![License](https://img.shields.io/badge/license-Apache--2.0-green.svg)](LICENSE.txt)

 capa detects capabilities in executable files.
-You run it against a PE, ELF, .NET module, shellcode file, or a sandbox report and it tells you what it thinks the program can do.
+You run it against a PE, ELF, .NET module, or shellcode file and it tells you what it thinks the program can do.
 For example, it might suggest that the file is a backdoor, is capable of installing services, or relies on HTTP to communicate.

 Check out:
@@ -125,96 +125,6 @@ function @ 0x4011C0
 ...
 ```

-Additionally, capa also supports analyzing [CAPE](https://github.com/kevoreilly/CAPEv2) sandbox reports for dynamic capabilty extraction.
-In order to use this, you first submit your sample to CAPE for analysis, and then run capa against the generated report (JSON).
-
-Here's an example of running capa against a packed binary, and then running capa against the CAPE report of that binary:
-
-```yaml
-$ capa 05be49819139a3fdcdbddbdefd298398779521f3d68daa25275cc77508e42310.exe
-WARNING:capa.capabilities.common:--------------------------------------------------------------------------------
-WARNING:capa.capabilities.common: This sample appears to be packed.
-WARNING:capa.capabilities.common: 
-WARNING:capa.capabilities.common: Packed samples have often been obfuscated to hide their logic.
-WARNING:capa.capabilities.common: capa cannot handle obfuscation well using static analysis. This means the results may be misleading or incomplete.
-WARNING:capa.capabilities.common: If possible, you should try to unpack this input file before analyzing it with capa.
-WARNING:capa.capabilities.common: Alternatively, run the sample in a supported sandbox and invoke capa against the report to obtain dynamic analysis results.
-WARNING:capa.capabilities.common: 
-WARNING:capa.capabilities.common: Identified via rule: (internal) packer file limitation
-WARNING:capa.capabilities.common: 
-WARNING:capa.capabilities.common: Use -v or -vv if you really want to see the capabilities identified by capa.
-WARNING:capa.capabilities.common:--------------------------------------------------------------------------------
-
-$ capa 05be49819139a3fdcdbddbdefd298398779521f3d68daa25275cc77508e42310.json
-
-┍━━━━━━━━━━━━━━━━━━━━━━━━┯━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┑
-│ ATT&CK Tactic          │ ATT&CK Technique                                                                   │
-┝━━━━━━━━━━━━━━━━━━━━━━━━┿━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┥
-│ CREDENTIAL ACCESS      │ Credentials from Password Stores T1555                                             │
-├────────────────────────┼────────────────────────────────────────────────────────────────────────────────────┤
-│ DEFENSE EVASION        │ File and Directory Permissions Modification T1222                                  │
-│                        │ Modify Registry T1112                                                              │
-│                        │ Obfuscated Files or Information T1027                                              │
-│                        │ Virtualization/Sandbox Evasion::User Activity Based Checks T1497.002               │
-├────────────────────────┼────────────────────────────────────────────────────────────────────────────────────┤
-│ DISCOVERY              │ Account Discovery T1087                                                            │
-│                        │ Application Window Discovery T1010                                                 │
-│                        │ File and Directory Discovery T1083                                                 │
-│                        │ Query Registry T1012                                                               │
-│                        │ System Information Discovery T1082                                                 │
-│                        │ System Location Discovery::System Language Discovery T1614.001                     │
-│                        │ System Owner/User Discovery T1033                                                  │
-├────────────────────────┼────────────────────────────────────────────────────────────────────────────────────┤
-│ EXECUTION              │ System Services::Service Execution T1569.002                                       │
-├────────────────────────┼────────────────────────────────────────────────────────────────────────────────────┤
-│ PERSISTENCE            │ Boot or Logon Autostart Execution::Registry Run Keys / Startup Folder T1547.001    │
-│                        │ Boot or Logon Autostart Execution::Winlogon Helper DLL T1547.004                   │
-│                        │ Create or Modify System Process::Windows Service T1543.003                         │
-┕━━━━━━━━━━━━━━━━━━━━━━━━┷━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┙
-
-┍━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┯━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┑
-│ Capability                                           │ Namespace                                            │
-┝━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┿━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┥
-│ check for unmoving mouse cursor (3 matches)          │ anti-analysis/anti-vm/vm-detection                   │
-│ gather bitkinex information                          │ collection/file-managers                             │
-│ gather classicftp information                        │ collection/file-managers                             │
-│ gather filezilla information                         │ collection/file-managers                             │
-│ gather total-commander information                   │ collection/file-managers                             │
-│ gather ultrafxp information                          │ collection/file-managers                             │
-│ resolve DNS (23 matches)                             │ communication/dns                                    │
-│ initialize Winsock library (7 matches)               │ communication/socket                                 │
-│ act as TCP client (3 matches)                        │ communication/tcp/client                             │
-│ create new key via CryptAcquireContext               │ data-manipulation/encryption                         │
-│ encrypt or decrypt via WinCrypt                      │ data-manipulation/encryption                         │
-│ hash data via WinCrypt                               │ data-manipulation/hashing                            │
-│ initialize hashing via WinCrypt                      │ data-manipulation/hashing                            │
-│ hash data with MD5                                   │ data-manipulation/hashing/md5                        │
-│ generate random numbers via WinAPI                   │ data-manipulation/prng                               │
-│ extract resource via kernel32 functions (2 matches)  │ executable/resource                                  │
-│ interact with driver via control codes (2 matches)   │ host-interaction/driver                              │
-│ get Program Files directory (18 matches)             │ host-interaction/file-system                         │
-│ get common file path (575 matches)                   │ host-interaction/file-system                         │
-│ create directory (2 matches)                         │ host-interaction/file-system/create                  │
-│ delete file                                          │ host-interaction/file-system/delete                  │
-│ get file attributes (122 matches)                    │ host-interaction/file-system/meta                    │
-│ set file attributes (8 matches)                      │ host-interaction/file-system/meta                    │
-│ move file                                            │ host-interaction/file-system/move                    │
-│ find taskbar (3 matches)                             │ host-interaction/gui/taskbar/find                    │
-│ get keyboard layout (12 matches)                     │ host-interaction/hardware/keyboard                   │
-│ get disk size                                        │ host-interaction/hardware/storage                    │
-│ get hostname (4 matches)                             │ host-interaction/os/hostname                         │
-│ allocate or change RWX memory (3 matches)            │ host-interaction/process/inject                      │
-│ query or enumerate registry key (3 matches)          │ host-interaction/registry                            │
-│ query or enumerate registry value (8 matches)        │ host-interaction/registry                            │
-│ delete registry key                                  │ host-interaction/registry/delete                     │
-│ start service                                        │ host-interaction/service/start                       │
-│ get session user name                                │ host-interaction/session                             │
-│ persist via Run registry key                         │ persistence/registry/run                             │
-│ persist via Winlogon Helper DLL registry key         │ persistence/registry/winlogon-helper                 │
-│ persist via Windows service (2 matches)              │ persistence/service                                  │
-┕━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┷━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┙
-```
-
 capa uses a collection of rules to identify capabilities within a program.
 These rules are easy to write, even for those new to reverse engineering.
 By authoring rules, you can extend the capabilities that capa recognizes.
@@ -225,30 +135,31 @@ Here's an example rule used by capa:
 ```yaml
 rule:
  meta:
-    name: create TCP socket
-    namespace: communication/socket/tcp
+    name: hash data with CRC32
+    namespace: data-manipulation/checksum/crc32
    authors:
-      - william.ballenthin@mandiant.com
-      - joakim@intezer.com
-      - anushka.virgaonkar@mandiant.com
-    scopes:
-      static: basic block
-      dynamic: call
+      - moritz.raabe@mandiant.com
+    scope: function
    mbc:
-      - Communication::Socket Communication::Create TCP Socket [C0001.011]
+      - Data::Checksum::CRC32 [C0032.001]
    examples:
-      - Practical Malware Analysis Lab 01-01.dll_:0x10001010
+      - 2D3EDC218A90F03089CC01715A9F047F:0x403CBD
+      - 7D28CB106CB54876B2A5C111724A07CD:0x402350  # RtlComputeCrc32
+      - 7EFF498DE13CC734262F87E6B3EF38AB:0x100084A6
  features:
    - or:
      - and:
-        - number: 6 = IPPROTO_TCP
-        - number: 1 = SOCK_STREAM
-        - number: 2 = AF_INET
+        - mnemonic: shr
        - or:
-          - api: ws2_32.socket
-          - api: ws2_32.WSASocket
-          - api: socket
-      - property/read: System.Net.Sockets.TcpClient::Client
+          - number: 0xEDB88320
+          - bytes: 00 00 00 00 96 30 07 77 2C 61 0E EE BA 51 09 99 19 C4 6D 07 8F F4 6A 70 35 A5 63 E9 A3 95 64 9E = crc32_tab
+        - number: 8
+        - characteristic: nzxor
+      - and:
+        - number: 0x8320
+        - number: 0xEDB8
+        - characteristic: nzxor
+      - api: RtlComputeCrc32
 ```

 The [github.com/mandiant/capa-rules](https://github.com/mandiant/capa-rules) repository contains hundreds of standard library rules that are distributed with capa.
@@ -259,8 +170,6 @@ capa explorer helps you identify interesting areas of a program and build new ca

 ![capa + IDA Pro integration](https://github.com/mandiant/capa/blob/master/doc/img/explorer_expanded.png)

-If you use Ghidra, you can use the Python 3 [Ghidra feature extractor](/capa/ghidra/). This integration enables capa to extract features directly from your Ghidra database, which can help you identify capabilities in programs that you analyze using Ghidra.
-
 # further information
 ## capa
 - [Installation](https://github.com/mandiant/capa/blob/master/doc/installation.md)
--- a/assets/classes.json.gz
+++ b/assets/classes.json.gz
--- a/assets/interfaces.json.gz
+++ b/assets/interfaces.json.gz
--- a/capa/capabilities/init.py
+++ b/capa/capabilities/init.py
--- a/capa/capabilities/common.py
+++ b/capa/capabilities/common.py
@@ -1,79 +0,0 @@
-# -*- coding: utf-8 -*-
-# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
-# Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at: [package root]/LICENSE.txt
-# Unless required by applicable law or agreed to in writing, software distributed under the License
-#  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and limitations under the License.
-import logging
-import itertools
-import collections
-from typing import Any, Tuple
-
-from capa.rules import Scope, RuleSet
-from capa.engine import FeatureSet, MatchResults
-from capa.features.address import NO_ADDRESS
-from capa.features.extractors.base_extractor import FeatureExtractor, StaticFeatureExtractor, DynamicFeatureExtractor
-
-logger = logging.getLogger(__name__)
-
-
-def find_file_capabilities(ruleset: RuleSet, extractor: FeatureExtractor, function_features: FeatureSet):
-    file_features: FeatureSet = collections.defaultdict(set)
-
-    for feature, va in itertools.chain(extractor.extract_file_features(), extractor.extract_global_features()):
-        # not all file features may have virtual addresses.
-        # if not, then at least ensure the feature shows up in the index.
-        # the set of addresses will still be empty.
-        if va:
-            file_features[feature].add(va)
-        else:
-            if feature not in file_features:
-                file_features[feature] = set()
-
-    logger.debug("analyzed file and extracted %d features", len(file_features))
-
-    file_features.update(function_features)
-
-    _, matches = ruleset.match(Scope.FILE, file_features, NO_ADDRESS)
-    return matches, len(file_features)
-
-
-def has_file_limitation(rules: RuleSet, capabilities: MatchResults, is_standalone=True) -> bool:
-    file_limitation_rules = list(filter(lambda r: r.is_file_limitation_rule(), rules.rules.values()))
-
-    for file_limitation_rule in file_limitation_rules:
-        if file_limitation_rule.name not in capabilities:
-            continue
-
-        logger.warning("-" * 80)
-        for line in file_limitation_rule.meta.get("description", "").split("\n"):
-            logger.warning(" %s", line)
-        logger.warning(" Identified via rule: %s", file_limitation_rule.name)
-        if is_standalone:
-            logger.warning(" ")
-            logger.warning(" Use -v or -vv if you really want to see the capabilities identified by capa.")
-        logger.warning("-" * 80)
-
-        # bail on first file limitation
-        return True
-
-    return False
-
-
-def find_capabilities(
-    ruleset: RuleSet, extractor: FeatureExtractor, disable_progress=None, **kwargs
-) -> Tuple[MatchResults, Any]:
-    from capa.capabilities.static import find_static_capabilities
-    from capa.capabilities.dynamic import find_dynamic_capabilities
-
-    if isinstance(extractor, StaticFeatureExtractor):
-        # for the time being, extractors are either static or dynamic.
-        # Remove this assertion once that has changed
-        assert not isinstance(extractor, DynamicFeatureExtractor)
-        return find_static_capabilities(ruleset, extractor, disable_progress=disable_progress, **kwargs)
-    if isinstance(extractor, DynamicFeatureExtractor):
-        return find_dynamic_capabilities(ruleset, extractor, disable_progress=disable_progress, **kwargs)
-
-    raise ValueError(f"unexpected extractor type: {extractor.__class__.__name__}")
--- a/capa/capabilities/dynamic.py
+++ b/capa/capabilities/dynamic.py
@@ -1,198 +0,0 @@
-# -*- coding: utf-8 -*-
-# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
-# Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at: [package root]/LICENSE.txt
-# Unless required by applicable law or agreed to in writing, software distributed under the License
-#  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and limitations under the License.
-import logging
-import itertools
-import collections
-from typing import Any, Tuple
-
-import tqdm
-
-import capa.perf
-import capa.features.freeze as frz
-import capa.render.result_document as rdoc
-from capa.rules import Scope, RuleSet
-from capa.engine import FeatureSet, MatchResults
-from capa.helpers import redirecting_print_to_tqdm
-from capa.capabilities.common import find_file_capabilities
-from capa.features.extractors.base_extractor import CallHandle, ThreadHandle, ProcessHandle, DynamicFeatureExtractor
-
-logger = logging.getLogger(__name__)
-
-
-def find_call_capabilities(
-    ruleset: RuleSet, extractor: DynamicFeatureExtractor, ph: ProcessHandle, th: ThreadHandle, ch: CallHandle
-) -> Tuple[FeatureSet, MatchResults]:
-    """
-    find matches for the given rules for the given call.
-
-    returns: tuple containing (features for call, match results for call)
-    """
-    # all features found for the call.
-    features: FeatureSet = collections.defaultdict(set)
-
-    for feature, addr in itertools.chain(
-        extractor.extract_call_features(ph, th, ch), extractor.extract_global_features()
-    ):
-        features[feature].add(addr)
-
-    # matches found at this thread.
-    _, matches = ruleset.match(Scope.CALL, features, ch.address)
-
-    for rule_name, res in matches.items():
-        rule = ruleset[rule_name]
-        for addr, _ in res:
-            capa.engine.index_rule_matches(features, rule, [addr])
-
-    return features, matches
-
-
-def find_thread_capabilities(
-    ruleset: RuleSet, extractor: DynamicFeatureExtractor, ph: ProcessHandle, th: ThreadHandle
-) -> Tuple[FeatureSet, MatchResults, MatchResults]:
-    """
-    find matches for the given rules within the given thread.
-
-    returns: tuple containing (features for thread, match results for thread, match results for calls)
-    """
-    # all features found within this thread,
-    # includes features found within calls.
-    features: FeatureSet = collections.defaultdict(set)
-
-    # matches found at the call scope.
-    # might be found at different calls, thats ok.
-    call_matches: MatchResults = collections.defaultdict(list)
-
-    for ch in extractor.get_calls(ph, th):
-        ifeatures, imatches = find_call_capabilities(ruleset, extractor, ph, th, ch)
-        for feature, vas in ifeatures.items():
-            features[feature].update(vas)
-
-        for rule_name, res in imatches.items():
-            call_matches[rule_name].extend(res)
-
-    for feature, va in itertools.chain(extractor.extract_thread_features(ph, th), extractor.extract_global_features()):
-        features[feature].add(va)
-
-    # matches found within this thread.
-    _, matches = ruleset.match(Scope.THREAD, features, th.address)
-
-    for rule_name, res in matches.items():
-        rule = ruleset[rule_name]
-        for va, _ in res:
-            capa.engine.index_rule_matches(features, rule, [va])
-
-    return features, matches, call_matches
-
-
-def find_process_capabilities(
-    ruleset: RuleSet, extractor: DynamicFeatureExtractor, ph: ProcessHandle
-) -> Tuple[MatchResults, MatchResults, MatchResults, int]:
-    """
-    find matches for the given rules within the given process.
-
-    returns: tuple containing (match results for process, match results for threads, match results for calls, number of features)
-    """
-    # all features found within this process,
-    # includes features found within threads (and calls).
-    process_features: FeatureSet = collections.defaultdict(set)
-
-    # matches found at the basic threads.
-    # might be found at different threads, thats ok.
-    thread_matches: MatchResults = collections.defaultdict(list)
-
-    # matches found at the call scope.
-    # might be found at different calls, thats ok.
-    call_matches: MatchResults = collections.defaultdict(list)
-
-    for th in extractor.get_threads(ph):
-        features, tmatches, cmatches = find_thread_capabilities(ruleset, extractor, ph, th)
-        for feature, vas in features.items():
-            process_features[feature].update(vas)
-
-        for rule_name, res in tmatches.items():
-            thread_matches[rule_name].extend(res)
-
-        for rule_name, res in cmatches.items():
-            call_matches[rule_name].extend(res)
-
-    for feature, va in itertools.chain(extractor.extract_process_features(ph), extractor.extract_global_features()):
-        process_features[feature].add(va)
-
-    _, process_matches = ruleset.match(Scope.PROCESS, process_features, ph.address)
-    return process_matches, thread_matches, call_matches, len(process_features)
-
-
-def find_dynamic_capabilities(
-    ruleset: RuleSet, extractor: DynamicFeatureExtractor, disable_progress=None
-) -> Tuple[MatchResults, Any]:
-    all_process_matches: MatchResults = collections.defaultdict(list)
-    all_thread_matches: MatchResults = collections.defaultdict(list)
-    all_call_matches: MatchResults = collections.defaultdict(list)
-
-    feature_counts = rdoc.DynamicFeatureCounts(file=0, processes=())
-
-    assert isinstance(extractor, DynamicFeatureExtractor)
-    with redirecting_print_to_tqdm(disable_progress):
-        with tqdm.contrib.logging.logging_redirect_tqdm():
-            pbar = tqdm.tqdm
-            if disable_progress:
-                # do not use tqdm to avoid unnecessary side effects when caller intends
-                # to disable progress completely
-                def pbar(s, *args, **kwargs):
-                    return s
-
-            processes = list(extractor.get_processes())
-
-            pb = pbar(processes, desc="matching", unit=" processes", leave=False)
-            for p in pb:
-                process_matches, thread_matches, call_matches, feature_count = find_process_capabilities(
-                    ruleset, extractor, p
-                )
-                feature_counts.processes += (
-                    rdoc.ProcessFeatureCount(address=frz.Address.from_capa(p.address), count=feature_count),
-                )
-                logger.debug("analyzed %s and extracted %d features", p.address, feature_count)
-
-                for rule_name, res in process_matches.items():
-                    all_process_matches[rule_name].extend(res)
-                for rule_name, res in thread_matches.items():
-                    all_thread_matches[rule_name].extend(res)
-                for rule_name, res in call_matches.items():
-                    all_call_matches[rule_name].extend(res)
-
-    # collection of features that captures the rule matches within process and thread scopes.
-    # mapping from feature (matched rule) to set of addresses at which it matched.
-    process_and_lower_features: FeatureSet = collections.defaultdict(set)
-    for rule_name, results in itertools.chain(
-        all_process_matches.items(), all_thread_matches.items(), all_call_matches.items()
-    ):
-        locations = {p[0] for p in results}
-        rule = ruleset[rule_name]
-        capa.engine.index_rule_matches(process_and_lower_features, rule, locations)
-
-    all_file_matches, feature_count = find_file_capabilities(ruleset, extractor, process_and_lower_features)
-    feature_counts.file = feature_count
-
-    matches = dict(
-        itertools.chain(
-            # each rule exists in exactly one scope,
-            # so there won't be any overlap among these following MatchResults,
-            # and we can merge the dictionaries naively.
-            all_thread_matches.items(),
-            all_process_matches.items(),
-            all_call_matches.items(),
-            all_file_matches.items(),
-        )
-    )
-
-    meta = {
-        "feature_counts": feature_counts,
-    }
-
-    return matches, meta
--- a/capa/capabilities/static.py
+++ b/capa/capabilities/static.py
@@ -1,233 +0,0 @@
-# -*- coding: utf-8 -*-
-# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
-# Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at: [package root]/LICENSE.txt
-# Unless required by applicable law or agreed to in writing, software distributed under the License
-#  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and limitations under the License.
-import time
-import logging
-import itertools
-import collections
-from typing import Any, Tuple
-
-import tqdm.contrib.logging
-
-import capa.perf
-import capa.features.freeze as frz
-import capa.render.result_document as rdoc
-from capa.rules import Scope, RuleSet
-from capa.engine import FeatureSet, MatchResults
-from capa.helpers import redirecting_print_to_tqdm
-from capa.capabilities.common import find_file_capabilities
-from capa.features.extractors.base_extractor import BBHandle, InsnHandle, FunctionHandle, StaticFeatureExtractor
-
-logger = logging.getLogger(__name__)
-
-
-def find_instruction_capabilities(
-    ruleset: RuleSet, extractor: StaticFeatureExtractor, f: FunctionHandle, bb: BBHandle, insn: InsnHandle
-) -> Tuple[FeatureSet, MatchResults]:
-    """
-    find matches for the given rules for the given instruction.
-
-    returns: tuple containing (features for instruction, match results for instruction)
-    """
-    # all features found for the instruction.
-    features: FeatureSet = collections.defaultdict(set)
-
-    for feature, addr in itertools.chain(
-        extractor.extract_insn_features(f, bb, insn), extractor.extract_global_features()
-    ):
-        features[feature].add(addr)
-
-    # matches found at this instruction.
-    _, matches = ruleset.match(Scope.INSTRUCTION, features, insn.address)
-
-    for rule_name, res in matches.items():
-        rule = ruleset[rule_name]
-        for addr, _ in res:
-            capa.engine.index_rule_matches(features, rule, [addr])
-
-    return features, matches
-
-
-def find_basic_block_capabilities(
-    ruleset: RuleSet, extractor: StaticFeatureExtractor, f: FunctionHandle, bb: BBHandle
-) -> Tuple[FeatureSet, MatchResults, MatchResults]:
-    """
-    find matches for the given rules within the given basic block.
-
-    returns: tuple containing (features for basic block, match results for basic block, match results for instructions)
-    """
-    # all features found within this basic block,
-    # includes features found within instructions.
-    features: FeatureSet = collections.defaultdict(set)
-
-    # matches found at the instruction scope.
-    # might be found at different instructions, thats ok.
-    insn_matches: MatchResults = collections.defaultdict(list)
-
-    for insn in extractor.get_instructions(f, bb):
-        ifeatures, imatches = find_instruction_capabilities(ruleset, extractor, f, bb, insn)
-        for feature, vas in ifeatures.items():
-            features[feature].update(vas)
-
-        for rule_name, res in imatches.items():
-            insn_matches[rule_name].extend(res)
-
-    for feature, va in itertools.chain(
-        extractor.extract_basic_block_features(f, bb), extractor.extract_global_features()
-    ):
-        features[feature].add(va)
-
-    # matches found within this basic block.
-    _, matches = ruleset.match(Scope.BASIC_BLOCK, features, bb.address)
-
-    for rule_name, res in matches.items():
-        rule = ruleset[rule_name]
-        for va, _ in res:
-            capa.engine.index_rule_matches(features, rule, [va])
-
-    return features, matches, insn_matches
-
-
-def find_code_capabilities(
-    ruleset: RuleSet, extractor: StaticFeatureExtractor, fh: FunctionHandle
-) -> Tuple[MatchResults, MatchResults, MatchResults, int]:
-    """
-    find matches for the given rules within the given function.
-
-    returns: tuple containing (match results for function, match results for basic blocks, match results for instructions, number of features)
-    """
-    # all features found within this function,
-    # includes features found within basic blocks (and instructions).
-    function_features: FeatureSet = collections.defaultdict(set)
-
-    # matches found at the basic block scope.
-    # might be found at different basic blocks, thats ok.
-    bb_matches: MatchResults = collections.defaultdict(list)
-
-    # matches found at the instruction scope.
-    # might be found at different instructions, thats ok.
-    insn_matches: MatchResults = collections.defaultdict(list)
-
-    for bb in extractor.get_basic_blocks(fh):
-        features, bmatches, imatches = find_basic_block_capabilities(ruleset, extractor, fh, bb)
-        for feature, vas in features.items():
-            function_features[feature].update(vas)
-
-        for rule_name, res in bmatches.items():
-            bb_matches[rule_name].extend(res)
-
-        for rule_name, res in imatches.items():
-            insn_matches[rule_name].extend(res)
-
-    for feature, va in itertools.chain(extractor.extract_function_features(fh), extractor.extract_global_features()):
-        function_features[feature].add(va)
-
-    _, function_matches = ruleset.match(Scope.FUNCTION, function_features, fh.address)
-    return function_matches, bb_matches, insn_matches, len(function_features)
-
-
-def find_static_capabilities(
-    ruleset: RuleSet, extractor: StaticFeatureExtractor, disable_progress=None
-) -> Tuple[MatchResults, Any]:
-    all_function_matches: MatchResults = collections.defaultdict(list)
-    all_bb_matches: MatchResults = collections.defaultdict(list)
-    all_insn_matches: MatchResults = collections.defaultdict(list)
-
-    feature_counts = rdoc.StaticFeatureCounts(file=0, functions=())
-    library_functions: Tuple[rdoc.LibraryFunction, ...] = ()
-
-    assert isinstance(extractor, StaticFeatureExtractor)
-    with redirecting_print_to_tqdm(disable_progress):
-        with tqdm.contrib.logging.logging_redirect_tqdm():
-            pbar = tqdm.tqdm
-            if capa.helpers.is_runtime_ghidra():
-                # Ghidrathon interpreter cannot properly handle
-                # the TMonitor thread that is created via a monitor_interval
-                # > 0
-                pbar.monitor_interval = 0
-            if disable_progress:
-                # do not use tqdm to avoid unnecessary side effects when caller intends
-                # to disable progress completely
-                def pbar(s, *args, **kwargs):
-                    return s
-
-            functions = list(extractor.get_functions())
-            n_funcs = len(functions)
-
-            pb = pbar(functions, desc="matching", unit=" functions", postfix="skipped 0 library functions", leave=False)
-            for f in pb:
-                t0 = time.time()
-                if extractor.is_library_function(f.address):
-                    function_name = extractor.get_function_name(f.address)
-                    logger.debug("skipping library function 0x%x (%s)", f.address, function_name)
-                    library_functions += (
-                        rdoc.LibraryFunction(address=frz.Address.from_capa(f.address), name=function_name),
-                    )
-                    n_libs = len(library_functions)
-                    percentage = round(100 * (n_libs / n_funcs))
-                    if isinstance(pb, tqdm.tqdm):
-                        pb.set_postfix_str(f"skipped {n_libs} library functions ({percentage}%)")
-                    continue
-
-                function_matches, bb_matches, insn_matches, feature_count = find_code_capabilities(
-                    ruleset, extractor, f
-                )
-                feature_counts.functions += (
-                    rdoc.FunctionFeatureCount(address=frz.Address.from_capa(f.address), count=feature_count),
-                )
-                t1 = time.time()
-
-                match_count = sum(len(res) for res in function_matches.values())
-                match_count += sum(len(res) for res in bb_matches.values())
-                match_count += sum(len(res) for res in insn_matches.values())
-                logger.debug(
-                    "analyzed function 0x%x and extracted %d features, %d matches in %0.02fs",
-                    f.address,
-                    feature_count,
-                    match_count,
-                    t1 - t0,
-                )
-
-                for rule_name, res in function_matches.items():
-                    all_function_matches[rule_name].extend(res)
-                for rule_name, res in bb_matches.items():
-                    all_bb_matches[rule_name].extend(res)
-                for rule_name, res in insn_matches.items():
-                    all_insn_matches[rule_name].extend(res)
-
-    # collection of features that captures the rule matches within function, BB, and instruction scopes.
-    # mapping from feature (matched rule) to set of addresses at which it matched.
-    function_and_lower_features: FeatureSet = collections.defaultdict(set)
-    for rule_name, results in itertools.chain(
-        all_function_matches.items(), all_bb_matches.items(), all_insn_matches.items()
-    ):
-        locations = {p[0] for p in results}
-        rule = ruleset[rule_name]
-        capa.engine.index_rule_matches(function_and_lower_features, rule, locations)
-
-    all_file_matches, feature_count = find_file_capabilities(ruleset, extractor, function_and_lower_features)
-    feature_counts.file = feature_count
-
-    matches = dict(
-        itertools.chain(
-            # each rule exists in exactly one scope,
-            # so there won't be any overlap among these following MatchResults,
-            # and we can merge the dictionaries naively.
-            all_insn_matches.items(),
-            all_bb_matches.items(),
-            all_function_matches.items(),
-            all_file_matches.items(),
-        )
-    )
-
-    meta = {
-        "feature_counts": feature_counts,
-        "library_functions": library_functions,
-    }
-
-    return matches, meta
--- a/capa/engine.py
+++ b/capa/engine.py
@@ -304,7 +304,7 @@ def match(rules: List["capa.rules.Rule"], features: FeatureSet, addr: Address) -
    other strategies can be imagined that match differently; implement these elsewhere.
    specifically, this routine does "top down" matching of the given rules against the feature set.
    """
-    results: MatchResults = collections.defaultdict(list)
+    results = collections.defaultdict(list)  # type: MatchResults

    # copy features so that we can modify it
    # without affecting the caller (keep this function pure)
--- a/capa/exceptions.py
+++ b/capa/exceptions.py
@@ -19,7 +19,3 @@ class UnsupportedArchError(ValueError):

 class UnsupportedOSError(ValueError):
    pass
-
-
-class EmptyReportError(ValueError):
-    pass
--- a/capa/features/address.py
+++ b/capa/features/address.py
@@ -43,79 +43,6 @@ class AbsoluteVirtualAddress(int, Address):
        return int.__hash__(self)


-class ProcessAddress(Address):
-    """an address of a process in a dynamic execution trace"""
-
-    def __init__(self, pid: int, ppid: int = 0):
-        assert ppid >= 0
-        assert pid > 0
-        self.ppid = ppid
-        self.pid = pid
-
-    def __repr__(self):
-        return "process(%s%s)" % (
-            f"ppid: {self.ppid}, " if self.ppid > 0 else "",
-            f"pid: {self.pid}",
-        )
-
-    def __hash__(self):
-        return hash((self.ppid, self.pid))
-
-    def __eq__(self, other):
-        assert isinstance(other, ProcessAddress)
-        return (self.ppid, self.pid) == (other.ppid, other.pid)
-
-    def __lt__(self, other):
-        assert isinstance(other, ProcessAddress)
-        return (self.ppid, self.pid) < (other.ppid, other.pid)
-
-
-class ThreadAddress(Address):
-    """addresses a thread in a dynamic execution trace"""
-
-    def __init__(self, process: ProcessAddress, tid: int):
-        assert tid >= 0
-        self.process = process
-        self.tid = tid
-
-    def __repr__(self):
-        return f"{self.process}, thread(tid: {self.tid})"
-
-    def __hash__(self):
-        return hash((self.process, self.tid))
-
-    def __eq__(self, other):
-        assert isinstance(other, ThreadAddress)
-        return (self.process, self.tid) == (other.process, other.tid)
-
-    def __lt__(self, other):
-        assert isinstance(other, ThreadAddress)
-        return (self.process, self.tid) < (other.process, other.tid)
-
-
-class DynamicCallAddress(Address):
-    """addesses a call in a dynamic execution trace"""
-
-    def __init__(self, thread: ThreadAddress, id: int):
-        assert id >= 0
-        self.thread = thread
-        self.id = id
-
-    def __repr__(self):
-        return f"{self.thread}, call(id: {self.id})"
-
-    def __hash__(self):
-        return hash((self.thread, self.id))
-
-    def __eq__(self, other):
-        assert isinstance(other, DynamicCallAddress)
-        return (self.thread, self.id) == (other.thread, other.id)
-
-    def __lt__(self, other):
-        assert isinstance(other, DynamicCallAddress)
-        return (self.thread, self.id) < (other.thread, other.id)
-
-
 class RelativeVirtualAddress(int, Address):
    """a memory address relative to a base address"""

@@ -177,34 +104,6 @@ class DNTokenOffsetAddress(Address):
        return self.token + self.offset


-class DexMethodAddress(int, Address):
-    def __new__(cls, offset: int):
-        return int.__new__(cls, offset)
-
-    def __repr__(self):
-        return f"DexMethodAddress(offset={hex(self)})"
-
-    def __str__(self) -> str:
-        return repr(self)
-
-    def __hash__(self):
-        return int.__hash__(self)
-
-
-class DexClassAddress(int, Address):
-    def __new__(cls, offset: int):
-        return int.__new__(cls, offset)
-
-    def __repr__(self):
-        return f"DexClassAddress(offset={hex(self)})"
-
-    def __str__(self) -> str:
-        return repr(self)
-
-    def __hash__(self):
-        return int.__hash__(self)
-
-
 class _NoAddress(Address):
    def __eq__(self, other):
        return True
--- a/capa/features/common.py
+++ b/capa/features/common.py
@@ -136,8 +136,8 @@ class Feature(abc.ABC):  # noqa: B024
        import capa.features.freeze.features

        return (
-            capa.features.freeze.features.feature_from_capa(self).model_dump_json()
-            < capa.features.freeze.features.feature_from_capa(other).model_dump_json()
+            capa.features.freeze.features.feature_from_capa(self).json()
+            < capa.features.freeze.features.feature_from_capa(other).json()
        )

    def get_name_str(self) -> str:
@@ -409,9 +409,7 @@ ARCH_I386 = "i386"
 ARCH_AMD64 = "amd64"
 # dotnet
 ARCH_ANY = "any"
-# dex
-ARCH_DALVIK = "dalvik"
-VALID_ARCH = (ARCH_I386, ARCH_AMD64, ARCH_ANY, ARCH_DALVIK)
+VALID_ARCH = (ARCH_I386, ARCH_AMD64, ARCH_ANY)


 class Arch(Feature):
@@ -423,11 +421,10 @@ class Arch(Feature):
 OS_WINDOWS = "windows"
 OS_LINUX = "linux"
 OS_MACOS = "macos"
-OS_ANDROID = "android"
 # dotnet
 OS_ANY = "any"
 VALID_OS = {os.value for os in capa.features.extractors.elf.OS}
-VALID_OS.update({OS_WINDOWS, OS_LINUX, OS_MACOS, OS_ANY, OS_ANDROID})
+VALID_OS.update({OS_WINDOWS, OS_LINUX, OS_MACOS, OS_ANY})
 # internal only, not to be used in rules
 OS_AUTO = "auto"

@@ -455,24 +452,11 @@ class OS(Feature):
 FORMAT_PE = "pe"
 FORMAT_ELF = "elf"
 FORMAT_DOTNET = "dotnet"
-FORMAT_DEX = "dex"
-VALID_FORMAT = (FORMAT_PE, FORMAT_ELF, FORMAT_DOTNET, FORMAT_DEX)
+VALID_FORMAT = (FORMAT_PE, FORMAT_ELF, FORMAT_DOTNET)
 # internal only, not to be used in rules
 FORMAT_AUTO = "auto"
 FORMAT_SC32 = "sc32"
 FORMAT_SC64 = "sc64"
-FORMAT_CAPE = "cape"
-STATIC_FORMATS = {
-    FORMAT_SC32,
-    FORMAT_SC64,
-    FORMAT_PE,
-    FORMAT_ELF,
-    FORMAT_DOTNET,
-    FORMAT_DEX,
-}
-DYNAMIC_FORMATS = {
-    FORMAT_CAPE,
-}
 FORMAT_FREEZE = "freeze"
 FORMAT_RESULT = "result"
 FORMAT_UNKNOWN = "unknown"
--- a/capa/features/extractors/base_extractor.py
+++ b/capa/features/extractors/base_extractor.py
@@ -7,18 +7,13 @@
 # See the License for the specific language governing permissions and limitations under the License.

 import abc
-import hashlib
 import dataclasses
 from typing import Any, Dict, Tuple, Union, Iterator
 from dataclasses import dataclass

-# TODO(williballenthin): use typing.TypeAlias directly when Python 3.9 is deprecated
-# https://github.com/mandiant/capa/issues/1699
-from typing_extensions import TypeAlias
-
 import capa.features.address
 from capa.features.common import Feature
-from capa.features.address import Address, ThreadAddress, ProcessAddress, DynamicCallAddress, AbsoluteVirtualAddress
+from capa.features.address import Address, AbsoluteVirtualAddress

 # feature extractors may reference functions, BBs, insns by opaque handle values.
 # you can use the `.address` property to get and render the address of the feature.
@@ -27,24 +22,6 @@ from capa.features.address import Address, ThreadAddress, ProcessAddress, Dynami
 # the feature extractor from which they were created.


-@dataclass
-class SampleHashes:
-    md5: str
-    sha1: str
-    sha256: str
-
-    @classmethod
-    def from_bytes(cls, buf: bytes) -> "SampleHashes":
-        md5 = hashlib.md5()
-        sha1 = hashlib.sha1()
-        sha256 = hashlib.sha256()
-        md5.update(buf)
-        sha1.update(buf)
-        sha256.update(buf)
-
-        return cls(md5=md5.hexdigest(), sha1=sha1.hexdigest(), sha256=sha256.hexdigest())
-
-
@dataclass
 class FunctionHandle:
    """reference to a function recognized by a feature extractor.
@@ -86,18 +63,16 @@ class InsnHandle:
    inner: Any


-class StaticFeatureExtractor:
+class FeatureExtractor:
    """
-    StaticFeatureExtractor defines the interface for fetching features from a
-    sample without running it; extractors that rely on the execution trace of
-    a sample must implement the other sibling class, DynamicFeatureExtracor.
+    FeatureExtractor defines the interface for fetching features from a sample.

    There may be multiple backends that support fetching features for capa.
    For example, we use vivisect by default, but also want to support saving
     and restoring features from a JSON file.
    When we restore the features, we'd like to use exactly the same matching logic
     to find matching rules.
-    Therefore, we can define a StaticFeatureExtractor that provides features from the
+    Therefore, we can define a FeatureExtractor that provides features from the
     serialized JSON file and do matching without a binary analysis pass.
    Also, this provides a way to hook in an IDA backend.

@@ -106,14 +81,13 @@ class StaticFeatureExtractor:

    __metaclass__ = abc.ABCMeta

-    def __init__(self, hashes: SampleHashes):
+    def __init__(self):
        #
        # note: a subclass should define ctor parameters for its own use.
        #  for example, the Vivisect feature extract might require the vw and/or path.
        # this base class doesn't know what to do with that info, though.
        #
        super().__init__()
-        self._sample_hashes = hashes

    @abc.abstractmethod
    def get_base_address(self) -> Union[AbsoluteVirtualAddress, capa.features.address._NoAddress]:
@@ -126,12 +100,6 @@ class StaticFeatureExtractor:
        """
        raise NotImplementedError()

-    def get_sample_hashes(self) -> SampleHashes:
-        """
-        fetch the hashes for the sample contained within the extractor.
-        """
-        return self._sample_hashes
-
    @abc.abstractmethod
    def extract_global_features(self) -> Iterator[Tuple[Feature, Address]]:
        """
@@ -294,177 +262,3 @@ class StaticFeatureExtractor:
          Tuple[Feature, Address]: feature and its location
        """
        raise NotImplementedError()
-
-
-@dataclass
-class ProcessHandle:
-    """
-    reference to a process extracted by the sandbox.
-
-    Attributes:
-        address: process's address (pid)
-        inner: sandbox-specific data
-    """
-
-    address: ProcessAddress
-    inner: Any
-
-
-@dataclass
-class ThreadHandle:
-    """
-    reference to a thread extracted by the sandbox.
-
-    Attributes:
-        address: thread's address (tid)
-        inner: sandbox-specific data
-    """
-
-    address: ThreadAddress
-    inner: Any
-
-
-@dataclass
-class CallHandle:
-    """
-    reference to an api call extracted by the sandbox.
-
-    Attributes:
-        address: call's address, such as event index or id
-        inner: sandbox-specific data
-    """
-
-    address: DynamicCallAddress
-    inner: Any
-
-
-class DynamicFeatureExtractor:
-    """
-    DynamicFeatureExtractor defines the interface for fetching features from a
-    sandbox' analysis of a sample; extractors that rely on statically analyzing
-    a sample must implement the sibling extractor, StaticFeatureExtractor.
-
-    Features are grouped mainly into threads that alongside their meta-features are also grouped into
-    processes (that also have their own features). Other scopes (such as function and file) may also apply
-    for a specific sandbox.
-
-    This class is not instantiated directly; it is the base class for other implementations.
-    """
-
-    __metaclass__ = abc.ABCMeta
-
-    def __init__(self, hashes: SampleHashes):
-        #
-        # note: a subclass should define ctor parameters for its own use.
-        #  for example, the Vivisect feature extract might require the vw and/or path.
-        # this base class doesn't know what to do with that info, though.
-        #
-        super().__init__()
-        self._sample_hashes = hashes
-
-    def get_sample_hashes(self) -> SampleHashes:
-        """
-        fetch the hashes for the sample contained within the extractor.
-        """
-        return self._sample_hashes
-
-    @abc.abstractmethod
-    def extract_global_features(self) -> Iterator[Tuple[Feature, Address]]:
-        """
-        extract features found at every scope ("global").
-
-        example::
-
-            extractor = CapeFeatureExtractor.from_report(json.loads(buf))
-            for feature, addr in extractor.get_global_features():
-                print(addr, feature)
-
-        yields:
-          Tuple[Feature, Address]: feature and its location
-        """
-        raise NotImplementedError()
-
-    @abc.abstractmethod
-    def extract_file_features(self) -> Iterator[Tuple[Feature, Address]]:
-        """
-        extract file-scope features.
-
-        example::
-
-            extractor = CapeFeatureExtractor.from_report(json.loads(buf))
-            for feature, addr in extractor.get_file_features():
-                print(addr, feature)
-
-        yields:
-          Tuple[Feature, Address]: feature and its location
-        """
-        raise NotImplementedError()
-
-    @abc.abstractmethod
-    def get_processes(self) -> Iterator[ProcessHandle]:
-        """
-        Enumerate processes in the trace.
-        """
-        raise NotImplementedError()
-
-    @abc.abstractmethod
-    def extract_process_features(self, ph: ProcessHandle) -> Iterator[Tuple[Feature, Address]]:
-        """
-        Yields all the features of a process. These include:
-        - file features of the process' image
-        """
-        raise NotImplementedError()
-
-    @abc.abstractmethod
-    def get_process_name(self, ph: ProcessHandle) -> str:
-        """
-        Returns the human-readable name for the given process,
-        such as the filename.
-        """
-        raise NotImplementedError()
-
-    @abc.abstractmethod
-    def get_threads(self, ph: ProcessHandle) -> Iterator[ThreadHandle]:
-        """
-        Enumerate threads in the given process.
-        """
-        raise NotImplementedError()
-
-    @abc.abstractmethod
-    def extract_thread_features(self, ph: ProcessHandle, th: ThreadHandle) -> Iterator[Tuple[Feature, Address]]:
-        """
-        Yields all the features of a thread. These include:
-        - sequenced api traces
-        """
-        raise NotImplementedError()
-
-    @abc.abstractmethod
-    def get_calls(self, ph: ProcessHandle, th: ThreadHandle) -> Iterator[CallHandle]:
-        """
-        Enumerate calls in the given thread
-        """
-        raise NotImplementedError()
-
-    @abc.abstractmethod
-    def extract_call_features(
-        self, ph: ProcessHandle, th: ThreadHandle, ch: CallHandle
-    ) -> Iterator[Tuple[Feature, Address]]:
-        """
-        Yields all features of a call. These include:
-        - api name
-        - bytes/strings/numbers extracted from arguments
-        """
-        raise NotImplementedError()
-
-    @abc.abstractmethod
-    def get_call_name(self, ph: ProcessHandle, th: ThreadHandle, ch: CallHandle) -> str:
-        """
-        Returns the human-readable name for the given call,
-        such as as rendered API log entry, like:
-
-            Foo(1, "two", b"\x00\x11") -> -1
-        """
-        raise NotImplementedError()
-
-
-FeatureExtractor: TypeAlias = Union[StaticFeatureExtractor, DynamicFeatureExtractor]
--- a/capa/features/extractors/binja/basicblock.py
+++ b/capa/features/extractors/binja/basicblock.py
@@ -75,11 +75,10 @@ def get_stack_string_len(f: Function, il: MediumLevelILInstruction) -> int:
        return 0

    dest = il.params[0]
-    if dest.operation in [MediumLevelILOperation.MLIL_ADDRESS_OF, MediumLevelILOperation.MLIL_VAR]:
-        var = dest.src
-    else:
+    if dest.operation != MediumLevelILOperation.MLIL_ADDRESS_OF:
        return 0

+    var = dest.src
    if var.source_type != VariableSourceType.StackVariableSourceType:
        return 0

--- a/capa/features/extractors/binja/extractor.py
+++ b/capa/features/extractors/binja/extractor.py
@@ -17,18 +17,12 @@ import capa.features.extractors.binja.function
 import capa.features.extractors.binja.basicblock
 from capa.features.common import Feature
 from capa.features.address import Address, AbsoluteVirtualAddress
-from capa.features.extractors.base_extractor import (
-    BBHandle,
-    InsnHandle,
-    SampleHashes,
-    FunctionHandle,
-    StaticFeatureExtractor,
-)
+from capa.features.extractors.base_extractor import BBHandle, InsnHandle, FunctionHandle, FeatureExtractor


-class BinjaFeatureExtractor(StaticFeatureExtractor):
+class BinjaFeatureExtractor(FeatureExtractor):
    def __init__(self, bv: binja.BinaryView):
-        super().__init__(hashes=SampleHashes.from_bytes(bv.file.raw.read(0, len(bv.file.raw))))
+        super().__init__()
        self.bv = bv
        self.global_features: List[Tuple[Feature, Address]] = []
        self.global_features.extend(capa.features.extractors.binja.file.extract_file_format(self.bv))
--- a/capa/features/extractors/binja/file.py
+++ b/capa/features/extractors/binja/file.py
@@ -17,7 +17,7 @@ import capa.features.extractors.strings
 from capa.features.file import Export, Import, Section, FunctionName
 from capa.features.common import FORMAT_PE, FORMAT_ELF, Format, String, Feature, Characteristic
 from capa.features.address import NO_ADDRESS, Address, FileOffsetAddress, AbsoluteVirtualAddress
-from capa.features.extractors.binja.helpers import read_c_string, unmangle_c_name
+from capa.features.extractors.binja.helpers import unmangle_c_name


 def check_segment_for_pe(bv: BinaryView, seg: Segment) -> Iterator[Tuple[int, int]]:
@@ -82,24 +82,6 @@ def extract_file_export_names(bv: BinaryView) -> Iterator[Tuple[Feature, Address
            if name != unmangled_name:
                yield Export(unmangled_name), AbsoluteVirtualAddress(sym.address)

-    for sym in bv.get_symbols_of_type(SymbolType.DataSymbol):
-        if sym.binding not in [SymbolBinding.GlobalBinding]:
-            continue
-
-        name = sym.short_name
-        if not name.startswith("__forwarder_name"):
-            continue
-
-        # Due to https://github.com/Vector35/binaryninja-api/issues/4641, in binja version 3.5, the symbol's name
-        # does not contain the DLL name. As a workaround, we read the C string at the symbol's address, which contains
-        # both the DLL name and the function name.
-        # Once the above issue is closed in the next binjs stable release, we can update the code here to use the
-        # symbol name directly.
-        name = read_c_string(bv, sym.address, 1024)
-        forwarded_name = capa.features.extractors.helpers.reformat_forwarded_export_name(name)
-        yield Export(forwarded_name), AbsoluteVirtualAddress(sym.address)
-        yield Characteristic("forwarded export"), AbsoluteVirtualAddress(sym.address)
-

 def extract_file_import_names(bv: BinaryView) -> Iterator[Tuple[Feature, Address]]:
    """extract function imports
@@ -115,13 +97,13 @@ def extract_file_import_names(bv: BinaryView) -> Iterator[Tuple[Feature, Address
    for sym in bv.get_symbols_of_type(SymbolType.ImportAddressSymbol):
        lib_name = str(sym.namespace)
        addr = AbsoluteVirtualAddress(sym.address)
-        for name in capa.features.extractors.helpers.generate_symbols(lib_name, sym.short_name, include_dll=True):
+        for name in capa.features.extractors.helpers.generate_symbols(lib_name, sym.short_name):
            yield Import(name), addr

        ordinal = sym.ordinal
        if ordinal != 0 and (lib_name != ""):
            ordinal_name = f"#{ordinal}"
-            for name in capa.features.extractors.helpers.generate_symbols(lib_name, ordinal_name, include_dll=True):
+            for name in capa.features.extractors.helpers.generate_symbols(lib_name, ordinal_name):
                yield Import(name), addr


@@ -143,17 +125,15 @@ def extract_file_function_names(bv: BinaryView) -> Iterator[Tuple[Feature, Addre
    """
    for sym_name in bv.symbols:
        for sym in bv.symbols[sym_name]:
-            if sym.type not in [SymbolType.LibraryFunctionSymbol, SymbolType.FunctionSymbol]:
-                continue
-
-            name = sym.short_name
-            yield FunctionName(name), sym.address
-            if name.startswith("_"):
-                # some linkers may prefix linked routines with a `_` to avoid name collisions.
-                # extract features for both the mangled and un-mangled representations.
-                # e.g. `_fwrite` -> `fwrite`
-                # see: https://stackoverflow.com/a/2628384/87207
-                yield FunctionName(name[1:]), sym.address
+            if sym.type == SymbolType.LibraryFunctionSymbol:
+                name = sym.short_name
+                yield FunctionName(name), sym.address
+                if name.startswith("_"):
+                    # some linkers may prefix linked routines with a `_` to avoid name collisions.
+                    # extract features for both the mangled and un-mangled representations.
+                    # e.g. `_fwrite` -> `fwrite`
+                    # see: https://stackoverflow.com/a/2628384/87207
+                    yield FunctionName(name[1:]), sym.address


 def extract_file_format(bv: BinaryView) -> Iterator[Tuple[Feature, Address]]:
--- a/capa/features/extractors/binja/function.py
+++ b/capa/features/extractors/binja/function.py
@@ -7,9 +7,8 @@
 # See the License for the specific language governing permissions and limitations under the License.
 from typing import Tuple, Iterator

-from binaryninja import Function, BinaryView, SymbolType, RegisterValueType, LowLevelILOperation
+from binaryninja import Function, BinaryView, LowLevelILOperation

-from capa.features.file import FunctionName
 from capa.features.common import Feature, Characteristic
 from capa.features.address import Address, AbsoluteVirtualAddress
 from capa.features.extractors import loops
@@ -24,27 +23,13 @@ def extract_function_calls_to(fh: FunctionHandle):
        # Everything that is a code reference to the current function is considered a caller, which actually includes
        # many other references that are NOT a caller. For example, an instruction `push function_start` will also be
        # considered a caller to the function
-        llil = caller.llil
-        if (llil is None) or llil.operation not in [
+        if caller.llil is not None and caller.llil.operation in [
            LowLevelILOperation.LLIL_CALL,
            LowLevelILOperation.LLIL_CALL_STACK_ADJUST,
            LowLevelILOperation.LLIL_JUMP,
            LowLevelILOperation.LLIL_TAILCALL,
        ]:
-            continue
-
-        if llil.dest.value.type not in [
-            RegisterValueType.ImportedAddressValue,
-            RegisterValueType.ConstantValue,
-            RegisterValueType.ConstantPointerValue,
-        ]:
-            continue
-
-        address = llil.dest.value.value
-        if address != func.start:
-            continue
-
-        yield Characteristic("calls to"), AbsoluteVirtualAddress(caller.address)
+            yield Characteristic("calls to"), AbsoluteVirtualAddress(caller.address)


 def extract_function_loop(fh: FunctionHandle):
@@ -74,31 +59,10 @@ def extract_recursive_call(fh: FunctionHandle):
            yield Characteristic("recursive call"), fh.address


-def extract_function_name(fh: FunctionHandle):
-    """extract function names (e.g., symtab names)"""
-    func: Function = fh.inner
-    bv: BinaryView = func.view
-    if bv is None:
-        return
-
-    for sym in bv.get_symbols(func.start):
-        if sym.type not in [SymbolType.LibraryFunctionSymbol, SymbolType.FunctionSymbol]:
-            continue
-
-        name = sym.short_name
-        yield FunctionName(name), sym.address
-        if name.startswith("_"):
-            # some linkers may prefix linked routines with a `_` to avoid name collisions.
-            # extract features for both the mangled and un-mangled representations.
-            # e.g. `_fwrite` -> `fwrite`
-            # see: https://stackoverflow.com/a/2628384/87207
-            yield FunctionName(name[1:]), sym.address
-
-
 def extract_features(fh: FunctionHandle) -> Iterator[Tuple[Feature, Address]]:
    for func_handler in FUNCTION_HANDLERS:
        for feature, addr in func_handler(fh):
            yield feature, addr


-FUNCTION_HANDLERS = (extract_function_calls_to, extract_function_loop, extract_recursive_call, extract_function_name)
+FUNCTION_HANDLERS = (extract_function_calls_to, extract_function_loop, extract_recursive_call)
--- a/capa/features/extractors/binja/helpers.py
+++ b/capa/features/extractors/binja/helpers.py
@@ -9,7 +9,7 @@ import re
 from typing import List, Callable
 from dataclasses import dataclass

-from binaryninja import BinaryView, LowLevelILInstruction
+from binaryninja import LowLevelILInstruction
 from binaryninja.architecture import InstructionTextToken


@@ -51,19 +51,3 @@ def unmangle_c_name(name: str) -> str:
            return match.group(1)

    return name
-
-
-def read_c_string(bv: BinaryView, offset: int, max_len: int) -> str:
-    s: List[str] = []
-    while len(s) < max_len:
-        try:
-            c = bv.read(offset + len(s), 1)[0]
-        except Exception:
-            break
-
-        if c == 0:
-            break
-
-        s.append(chr(c))
-
-    return "".join(s)
--- a/capa/features/extractors/binja/insn.py
+++ b/capa/features/extractors/binja/insn.py
@@ -94,32 +94,28 @@ def extract_insn_api_features(fh: FunctionHandle, bbh: BBHandle, ih: InsnHandle)
                candidate_addrs.append(stub_addr)

            for address in candidate_addrs:
-                for sym in func.view.get_symbols(address):
-                    if sym is None or sym.type not in [
-                        SymbolType.ImportAddressSymbol,
-                        SymbolType.ImportedFunctionSymbol,
-                        SymbolType.FunctionSymbol,
-                    ]:
-                        continue
+                sym = func.view.get_symbol_at(address)
+                if sym is None or sym.type not in [SymbolType.ImportAddressSymbol, SymbolType.ImportedFunctionSymbol]:
+                    continue

-                    sym_name = sym.short_name
+                sym_name = sym.short_name

-                    lib_name = ""
-                    import_lib = bv.lookup_imported_object_library(sym.address)
-                    if import_lib is not None:
-                        lib_name = import_lib[0].name
-                        if lib_name.endswith(".dll"):
-                            lib_name = lib_name[:-4]
-                        elif lib_name.endswith(".so"):
-                            lib_name = lib_name[:-3]
+                lib_name = ""
+                import_lib = bv.lookup_imported_object_library(sym.address)
+                if import_lib is not None:
+                    lib_name = import_lib[0].name
+                    if lib_name.endswith(".dll"):
+                        lib_name = lib_name[:-4]
+                    elif lib_name.endswith(".so"):
+                        lib_name = lib_name[:-3]

-                    for name in capa.features.extractors.helpers.generate_symbols(lib_name, sym_name):
+                for name in capa.features.extractors.helpers.generate_symbols(lib_name, sym_name):
+                    yield API(name), ih.address
+
+                if sym_name.startswith("_"):
+                    for name in capa.features.extractors.helpers.generate_symbols(lib_name, sym_name[1:]):
                        yield API(name), ih.address

-                    if sym_name.startswith("_"):
-                        for name in capa.features.extractors.helpers.generate_symbols(lib_name, sym_name[1:]):
-                            yield API(name), ih.address
-

 def extract_insn_number_features(
    fh: FunctionHandle, bbh: BBHandle, ih: InsnHandle
--- a/capa/features/extractors/cape/init.py
+++ b/capa/features/extractors/cape/init.py
--- a/capa/features/extractors/cape/call.py
+++ b/capa/features/extractors/cape/call.py
@@ -1,62 +0,0 @@
-# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
-# Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at: [package root]/LICENSE.txt
-# Unless required by applicable law or agreed to in writing, software distributed under the License
-#  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and limitations under the License.
-
-import logging
-from typing import Tuple, Iterator
-
-from capa.helpers import assert_never
-from capa.features.insn import API, Number
-from capa.features.common import String, Feature
-from capa.features.address import Address
-from capa.features.extractors.cape.models import Call
-from capa.features.extractors.base_extractor import CallHandle, ThreadHandle, ProcessHandle
-
-logger = logging.getLogger(__name__)
-
-
-def extract_call_features(ph: ProcessHandle, th: ThreadHandle, ch: CallHandle) -> Iterator[Tuple[Feature, Address]]:
-    """
-    this method extracts the given call's features (such as API name and arguments),
-    and returns them as API, Number, and String features.
-
-    args:
-      ph: process handle (for defining the extraction scope)
-      th: thread handle (for defining the extraction scope)
-      ch: call handle (for defining the extraction scope)
-
-    yields:
-      Feature, address; where Feature is either: API, Number, or String.
-    """
-    call: Call = ch.inner
-
-    # list similar to disassembly: arguments right-to-left, call
-    for arg in reversed(call.arguments):
-        value = arg.value
-        if isinstance(value, list) and len(value) == 0:
-            # unsure why CAPE captures arguments as empty lists?
-            continue
-
-        elif isinstance(value, str):
-            yield String(value), ch.address
-
-        elif isinstance(value, int):
-            yield Number(value), ch.address
-
-        else:
-            assert_never(value)
-
-    yield API(call.api), ch.address
-
-
-def extract_features(ph: ProcessHandle, th: ThreadHandle, ch: CallHandle) -> Iterator[Tuple[Feature, Address]]:
-    for handler in CALL_HANDLERS:
-        for feature, addr in handler(ph, th, ch):
-            yield feature, addr
-
-
-CALL_HANDLERS = (extract_call_features,)
--- a/capa/features/extractors/cape/extractor.py
+++ b/capa/features/extractors/cape/extractor.py
@@ -1,145 +0,0 @@
-# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
-# Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at: [package root]/LICENSE.txt
-# Unless required by applicable law or agreed to in writing, software distributed under the License
-#  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and limitations under the License.
-
-import logging
-from typing import Dict, Tuple, Union, Iterator
-
-import capa.features.extractors.cape.call
-import capa.features.extractors.cape.file
-import capa.features.extractors.cape.thread
-import capa.features.extractors.cape.global_
-import capa.features.extractors.cape.process
-from capa.exceptions import EmptyReportError, UnsupportedFormatError
-from capa.features.common import Feature, Characteristic
-from capa.features.address import NO_ADDRESS, Address, AbsoluteVirtualAddress, _NoAddress
-from capa.features.extractors.cape.models import Call, Static, Process, CapeReport
-from capa.features.extractors.base_extractor import (
-    CallHandle,
-    SampleHashes,
-    ThreadHandle,
-    ProcessHandle,
-    DynamicFeatureExtractor,
-)
-
-logger = logging.getLogger(__name__)
-
-TESTED_VERSIONS = {"2.2-CAPE", "2.4-CAPE"}
-
-
-class CapeExtractor(DynamicFeatureExtractor):
-    def __init__(self, report: CapeReport):
-        super().__init__(
-            hashes=SampleHashes(
-                md5=report.target.file.md5.lower(),
-                sha1=report.target.file.sha1.lower(),
-                sha256=report.target.file.sha256.lower(),
-            )
-        )
-        self.report: CapeReport = report
-
-        # pre-compute these because we'll yield them at *every* scope.
-        self.global_features = list(capa.features.extractors.cape.global_.extract_features(self.report))
-
-    def get_base_address(self) -> Union[AbsoluteVirtualAddress, _NoAddress, None]:
-        # value according to the PE header, the actual trace may use a different imagebase
-        assert self.report.static is not None and self.report.static.pe is not None
-        return AbsoluteVirtualAddress(self.report.static.pe.imagebase)
-
-    def extract_global_features(self) -> Iterator[Tuple[Feature, Address]]:
-        yield from self.global_features
-
-    def extract_file_features(self) -> Iterator[Tuple[Feature, Address]]:
-        yield from capa.features.extractors.cape.file.extract_features(self.report)
-
-    def get_processes(self) -> Iterator[ProcessHandle]:
-        yield from capa.features.extractors.cape.file.get_processes(self.report)
-
-    def extract_process_features(self, ph: ProcessHandle) -> Iterator[Tuple[Feature, Address]]:
-        yield from capa.features.extractors.cape.process.extract_features(ph)
-
-    def get_process_name(self, ph) -> str:
-        process: Process = ph.inner
-        return process.process_name
-
-    def get_threads(self, ph: ProcessHandle) -> Iterator[ThreadHandle]:
-        yield from capa.features.extractors.cape.process.get_threads(ph)
-
-    def extract_thread_features(self, ph: ProcessHandle, th: ThreadHandle) -> Iterator[Tuple[Feature, Address]]:
-        if False:
-            # force this routine to be a generator,
-            # but we don't actually have any elements to generate.
-            yield Characteristic("never"), NO_ADDRESS
-        return
-
-    def get_calls(self, ph: ProcessHandle, th: ThreadHandle) -> Iterator[CallHandle]:
-        yield from capa.features.extractors.cape.thread.get_calls(ph, th)
-
-    def extract_call_features(
-        self, ph: ProcessHandle, th: ThreadHandle, ch: CallHandle
-    ) -> Iterator[Tuple[Feature, Address]]:
-        yield from capa.features.extractors.cape.call.extract_features(ph, th, ch)
-
-    def get_call_name(self, ph, th, ch) -> str:
-        call: Call = ch.inner
-
-        parts = []
-        parts.append(call.api)
-        parts.append("(")
-        for argument in call.arguments:
-            parts.append(argument.name)
-            parts.append("=")
-
-            if argument.pretty_value:
-                parts.append(argument.pretty_value)
-            else:
-                if isinstance(argument.value, int):
-                    parts.append(hex(argument.value))
-                elif isinstance(argument.value, str):
-                    parts.append('"')
-                    parts.append(argument.value)
-                    parts.append('"')
-                elif isinstance(argument.value, list):
-                    pass
-                else:
-                    capa.helpers.assert_never(argument.value)
-
-            parts.append(", ")
-        if call.arguments:
-            # remove the trailing comma
-            parts.pop()
-        parts.append(")")
-        parts.append(" -> ")
-        if call.pretty_return:
-            parts.append(call.pretty_return)
-        else:
-            parts.append(hex(call.return_))
-
-        return "".join(parts)
-
-    @classmethod
-    def from_report(cls, report: Dict) -> "CapeExtractor":
-        cr = CapeReport.model_validate(report)
-
-        if cr.info.version not in TESTED_VERSIONS:
-            logger.warning("CAPE version '%s' not tested/supported yet", cr.info.version)
-
-        # observed in 2.4-CAPE reports from capesandbox.com
-        if cr.static is None and cr.target.file.pe is not None:
-            cr.static = Static()
-            cr.static.pe = cr.target.file.pe
-
-        if cr.static is None:
-            raise UnsupportedFormatError("CAPE report missing static analysis")
-
-        if cr.static.pe is None:
-            raise UnsupportedFormatError("CAPE report missing PE analysis")
-
-        if len(cr.behavior.processes) == 0:
-            raise EmptyReportError("CAPE did not capture any processes")
-
-        return cls(cr)
--- a/capa/features/extractors/cape/file.py
+++ b/capa/features/extractors/cape/file.py
@@ -1,132 +0,0 @@
-# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
-# Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at: [package root]/LICENSE.txt
-# Unless required by applicable law or agreed to in writing, software distributed under the License
-#  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and limitations under the License.
-
-import logging
-from typing import Tuple, Iterator
-
-from capa.features.file import Export, Import, Section
-from capa.features.common import String, Feature
-from capa.features.address import NO_ADDRESS, Address, ProcessAddress, AbsoluteVirtualAddress
-from capa.features.extractors.helpers import generate_symbols
-from capa.features.extractors.cape.models import CapeReport
-from capa.features.extractors.base_extractor import ProcessHandle
-
-logger = logging.getLogger(__name__)
-
-
-def get_processes(report: CapeReport) -> Iterator[ProcessHandle]:
-    """
-    get all the created processes for a sample
-    """
-    seen_processes = {}
-    for process in report.behavior.processes:
-        addr = ProcessAddress(pid=process.process_id, ppid=process.parent_id)
-        yield ProcessHandle(address=addr, inner=process)
-
-        # check for pid and ppid reuse
-        if addr not in seen_processes:
-            seen_processes[addr] = [process]
-        else:
-            logger.warning(
-                "pid and ppid reuse detected between process %s and process%s: %s",
-                process,
-                "es" if len(seen_processes[addr]) > 1 else "",
-                seen_processes[addr],
-            )
-            seen_processes[addr].append(process)
-
-
-def extract_import_names(report: CapeReport) -> Iterator[Tuple[Feature, Address]]:
-    """
-    extract imported function names
-    """
-    assert report.static is not None and report.static.pe is not None
-    imports = report.static.pe.imports
-
-    if isinstance(imports, dict):
-        imports = list(imports.values())
-
-    assert isinstance(imports, list)
-
-    for library in imports:
-        for function in library.imports:
-            if not function.name:
-                continue
-
-            for name in generate_symbols(library.dll, function.name, include_dll=True):
-                yield Import(name), AbsoluteVirtualAddress(function.address)
-
-
-def extract_export_names(report: CapeReport) -> Iterator[Tuple[Feature, Address]]:
-    assert report.static is not None and report.static.pe is not None
-    for function in report.static.pe.exports:
-        yield Export(function.name), AbsoluteVirtualAddress(function.address)
-
-
-def extract_section_names(report: CapeReport) -> Iterator[Tuple[Feature, Address]]:
-    assert report.static is not None and report.static.pe is not None
-    for section in report.static.pe.sections:
-        yield Section(section.name), AbsoluteVirtualAddress(section.virtual_address)
-
-
-def extract_file_strings(report: CapeReport) -> Iterator[Tuple[Feature, Address]]:
-    if report.strings is not None:
-        for string in report.strings:
-            yield String(string), NO_ADDRESS
-
-
-def extract_used_regkeys(report: CapeReport) -> Iterator[Tuple[Feature, Address]]:
-    for regkey in report.behavior.summary.keys:
-        yield String(regkey), NO_ADDRESS
-
-
-def extract_used_files(report: CapeReport) -> Iterator[Tuple[Feature, Address]]:
-    for file in report.behavior.summary.files:
-        yield String(file), NO_ADDRESS
-
-
-def extract_used_mutexes(report: CapeReport) -> Iterator[Tuple[Feature, Address]]:
-    for mutex in report.behavior.summary.mutexes:
-        yield String(mutex), NO_ADDRESS
-
-
-def extract_used_commands(report: CapeReport) -> Iterator[Tuple[Feature, Address]]:
-    for cmd in report.behavior.summary.executed_commands:
-        yield String(cmd), NO_ADDRESS
-
-
-def extract_used_apis(report: CapeReport) -> Iterator[Tuple[Feature, Address]]:
-    for symbol in report.behavior.summary.resolved_apis:
-        yield String(symbol), NO_ADDRESS
-
-
-def extract_used_services(report: CapeReport) -> Iterator[Tuple[Feature, Address]]:
-    for svc in report.behavior.summary.created_services:
-        yield String(svc), NO_ADDRESS
-    for svc in report.behavior.summary.started_services:
-        yield String(svc), NO_ADDRESS
-
-
-def extract_features(report: CapeReport) -> Iterator[Tuple[Feature, Address]]:
-    for handler in FILE_HANDLERS:
-        for feature, addr in handler(report):
-            yield feature, addr
-
-
-FILE_HANDLERS = (
-    extract_import_names,
-    extract_export_names,
-    extract_section_names,
-    extract_file_strings,
-    extract_used_regkeys,
-    extract_used_files,
-    extract_used_mutexes,
-    extract_used_commands,
-    extract_used_apis,
-    extract_used_services,
-)
--- a/capa/features/extractors/cape/global_.py
+++ b/capa/features/extractors/cape/global_.py
@@ -1,93 +0,0 @@
-# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
-# Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at: [package root]/LICENSE.txt
-# Unless required by applicable law or agreed to in writing, software distributed under the License
-#  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and limitations under the License.
-
-import logging
-from typing import Tuple, Iterator
-
-from capa.features.common import (
-    OS,
-    OS_ANY,
-    OS_LINUX,
-    ARCH_I386,
-    FORMAT_PE,
-    ARCH_AMD64,
-    FORMAT_ELF,
-    OS_WINDOWS,
-    Arch,
-    Format,
-    Feature,
-)
-from capa.features.address import NO_ADDRESS, Address
-from capa.features.extractors.cape.models import CapeReport
-
-logger = logging.getLogger(__name__)
-
-
-def extract_arch(report: CapeReport) -> Iterator[Tuple[Feature, Address]]:
-    if "Intel 80386" in report.target.file.type:
-        yield Arch(ARCH_I386), NO_ADDRESS
-    elif "x86-64" in report.target.file.type:
-        yield Arch(ARCH_AMD64), NO_ADDRESS
-    else:
-        logger.warning("unrecognized Architecture: %s", report.target.file.type)
-        raise ValueError(
-            f"unrecognized Architecture from the CAPE report; output of file command: {report.target.file.type}"
-        )
-
-
-def extract_format(report: CapeReport) -> Iterator[Tuple[Feature, Address]]:
-    if "PE" in report.target.file.type:
-        yield Format(FORMAT_PE), NO_ADDRESS
-    elif "ELF" in report.target.file.type:
-        yield Format(FORMAT_ELF), NO_ADDRESS
-    else:
-        logger.warning("unknown file format, file command output: %s", report.target.file.type)
-        raise ValueError(
-            "unrecognized file format from the CAPE report; output of file command: {report.target.file.type}"
-        )
-
-
-def extract_os(report: CapeReport) -> Iterator[Tuple[Feature, Address]]:
-    # this variable contains the output of the file command
-    file_output = report.target.file.type
-
-    if "windows" in file_output.lower():
-        yield OS(OS_WINDOWS), NO_ADDRESS
-    elif "elf" in file_output.lower():
-        # operating systems recognized by the file command: https://github.com/file/file/blob/master/src/readelf.c#L609
-        if "Linux" in file_output:
-            yield OS(OS_LINUX), NO_ADDRESS
-        elif "Hurd" in file_output:
-            yield OS("hurd"), NO_ADDRESS
-        elif "Solaris" in file_output:
-            yield OS("solaris"), NO_ADDRESS
-        elif "kFreeBSD" in file_output:
-            yield OS("freebsd"), NO_ADDRESS
-        elif "kNetBSD" in file_output:
-            yield OS("netbsd"), NO_ADDRESS
-        else:
-            # if the operating system information is missing from the cape report, it's likely a bug
-            logger.warning("unrecognized OS: %s", file_output)
-            raise ValueError("unrecognized OS from the CAPE report; output of file command: {file_output}")
-    else:
-        # the sample is shellcode
-        logger.debug("unsupported file format, file command output: %s", file_output)
-        yield OS(OS_ANY), NO_ADDRESS
-
-
-def extract_features(report: CapeReport) -> Iterator[Tuple[Feature, Address]]:
-    for global_handler in GLOBAL_HANDLER:
-        for feature, addr in global_handler(report):
-            yield feature, addr
-
-
-GLOBAL_HANDLER = (
-    extract_format,
-    extract_os,
-    extract_arch,
-)
--- a/capa/features/extractors/cape/helpers.py
+++ b/capa/features/extractors/cape/helpers.py
@@ -1,29 +0,0 @@
-# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
-# Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at: [package root]/LICENSE.txt
-# Unless required by applicable law or agreed to in writing, software distributed under the License
-#  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and limitations under the License.
-
-from typing import Any, Dict, List
-
-from capa.features.extractors.base_extractor import ProcessHandle
-
-
-def find_process(processes: List[Dict[str, Any]], ph: ProcessHandle) -> Dict[str, Any]:
-    """
-    find a specific process identified by a process handler.
-
-    args:
-      processes: a list of processes extracted by CAPE
-      ph: handle of the sought process
-
-    return:
-      a CAPE-defined dictionary for the sought process' information
-    """
-
-    for process in processes:
-        if ph.address.ppid == process["parent_id"] and ph.address.pid == process["process_id"]:
-            return process
-    return {}
--- a/capa/features/extractors/cape/models.py
+++ b/capa/features/extractors/cape/models.py
@@ -1,446 +0,0 @@
-# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
-# Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at: [package root]/LICENSE.txt
-# Unless required by applicable law or agreed to in writing, software distributed under the License
-#  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and limitations under the License.
-import binascii
-from typing import Any, Dict, List, Union, Literal, Optional
-
-from pydantic import Field, BaseModel, ConfigDict
-from typing_extensions import Annotated, TypeAlias
-from pydantic.functional_validators import BeforeValidator
-
-
-def validate_hex_int(value):
-    if isinstance(value, str):
-        return int(value, 16) if value.startswith("0x") else int(value, 10)
-    else:
-        return value
-
-
-def validate_hex_bytes(value):
-    return binascii.unhexlify(value) if isinstance(value, str) else value
-
-
-HexInt = Annotated[int, BeforeValidator(validate_hex_int)]
-HexBytes = Annotated[bytes, BeforeValidator(validate_hex_bytes)]
-
-
-# a model that *cannot* have extra fields
-# if they do, pydantic raises an exception.
-# use this for models we rely upon and cannot change.
-#
-# for things that may be extended and we don't care,
-# use FlexibleModel.
-class ExactModel(BaseModel):
-    model_config = ConfigDict(extra="forbid")
-
-
-# a model that can have extra fields that we ignore.
-# use this if we don't want to raise an exception for extra
-# data fields that we didn't expect.
-class FlexibleModel(BaseModel):
-    pass
-
-
-# use this type to indicate that we won't model this data.
-# because its not relevant to our use in capa.
-#
-# while its nice to have full coverage of the data shape,
-# it can easily change and break our parsing.
-# so we really only want to describe what we'll use.
-Skip: TypeAlias = Optional[Any]
-
-
-# mark fields that we haven't seen yet and need to model.
-# pydantic should raise an error when encountering data
-# in a field with this type.
-# then we can update the model with the discovered shape.
-TODO: TypeAlias = None
-ListTODO: TypeAlias = List[None]
-DictTODO: TypeAlias = ExactModel
-
-EmptyDict: TypeAlias = BaseModel
-EmptyList: TypeAlias = List[Any]
-
-
-class Info(FlexibleModel):
-    version: str
-
-
-class ImportedSymbol(ExactModel):
-    address: HexInt
-    name: Optional[str] = None
-
-
-class ImportedDll(ExactModel):
-    dll: str
-    imports: List[ImportedSymbol]
-
-
-class DirectoryEntry(ExactModel):
-    name: str
-    virtual_address: HexInt
-    size: HexInt
-
-
-class Section(ExactModel):
-    name: str
-    raw_address: HexInt
-    virtual_address: HexInt
-    virtual_size: HexInt
-    size_of_data: HexInt
-    characteristics: str
-    characteristics_raw: HexInt
-    entropy: float
-
-
-class Resource(ExactModel):
-    name: str
-    language: Optional[str] = None
-    sublanguage: str
-    filetype: Optional[str]
-    offset: HexInt
-    size: HexInt
-    entropy: float
-
-
-class DigitalSigner(FlexibleModel):
-    md5_fingerprint: str
-    not_after: str
-    not_before: str
-    serial_number: str
-    sha1_fingerprint: str
-    sha256_fingerprint: str
-
-    issuer_commonName: Optional[str] = None
-    issuer_countryName: Optional[str] = None
-    issuer_localityName: Optional[str] = None
-    issuer_organizationName: Optional[str] = None
-    issuer_stateOrProvinceName: Optional[str] = None
-
-    subject_commonName: Optional[str] = None
-    subject_countryName: Optional[str] = None
-    subject_localityName: Optional[str] = None
-    subject_organizationName: Optional[str] = None
-    subject_stateOrProvinceName: Optional[str] = None
-
-    extensions_authorityInfoAccess_caIssuers: Optional[str] = None
-    extensions_authorityKeyIdentifier: Optional[str] = None
-    extensions_cRLDistributionPoints_0: Optional[str] = None
-    extensions_certificatePolicies_0: Optional[str] = None
-    extensions_subjectAltName_0: Optional[str] = None
-    extensions_subjectKeyIdentifier: Optional[str] = None
-
-
-class AuxSigner(ExactModel):
-    name: str
-    issued_to: str = Field(alias="Issued to")
-    issued_by: str = Field(alias="Issued by")
-    expires: str = Field(alias="Expires")
-    sha1_hash: str = Field(alias="SHA1 hash")
-
-
-class Signer(ExactModel):
-    aux_sha1: Optional[str] = None
-    aux_timestamp: Optional[str] = None
-    aux_valid: Optional[bool] = None
-    aux_error: Optional[bool] = None
-    aux_error_desc: Optional[str] = None
-    aux_signers: Optional[List[AuxSigner]] = None
-
-
-class Overlay(ExactModel):
-    offset: HexInt
-    size: HexInt
-
-
-class KV(ExactModel):
-    name: str
-    value: str
-
-
-class ExportedSymbol(ExactModel):
-    address: HexInt
-    name: str
-    ordinal: int
-
-
-class PE(ExactModel):
-    peid_signatures: TODO
-    imagebase: HexInt
-    entrypoint: HexInt
-    reported_checksum: HexInt
-    actual_checksum: HexInt
-    osversion: str
-    pdbpath: Optional[str] = None
-    timestamp: str
-
-    # List[ImportedDll], or Dict[basename(dll), ImportedDll]
-    imports: Union[List[ImportedDll], Dict[str, ImportedDll]]
-    imported_dll_count: Optional[int] = None
-    imphash: str
-
-    exported_dll_name: Optional[str] = None
-    exports: List[ExportedSymbol]
-
-    dirents: List[DirectoryEntry]
-    sections: List[Section]
-
-    ep_bytes: Optional[HexBytes] = None
-
-    overlay: Optional[Overlay] = None
-    resources: List[Resource]
-    versioninfo: List[KV]
-
-    # base64 encoded data
-    icon: Optional[str] = None
-    # MD5-like hash
-    icon_hash: Optional[str] = None
-    # MD5-like hash
-    icon_fuzzy: Optional[str] = None
-    # short hex string
-    icon_dhash: Optional[str] = None
-
-    digital_signers: List[DigitalSigner]
-    guest_signers: Signer
-
-
-# TODO(mr-tz): target.file.dotnet, target.file.extracted_files, target.file.extracted_files_tool,
-#  target.file.extracted_files_time
-# https://github.com/mandiant/capa/issues/1814
-class File(FlexibleModel):
-    type: str
-    cape_type_code: Optional[int] = None
-    cape_type: Optional[str] = None
-
-    pid: Optional[Union[int, Literal[""]]] = None
-    name: Union[List[str], str]
-    path: str
-    guest_paths: Union[List[str], str, None]
-    timestamp: Optional[str] = None
-
-    #
-    # hashes
-    #
-    crc32: str
-    md5: str
-    sha1: str
-    sha256: str
-    sha512: str
-    sha3_384: str
-    ssdeep: str
-    # unsure why this would ever be "False"
-    tlsh: Optional[Union[str, bool]] = None
-    rh_hash: Optional[str] = None
-
-    #
-    # other metadata, static analysis
-    #
-    size: int
-    pe: Optional[PE] = None
-    ep_bytes: Optional[HexBytes] = None
-    entrypoint: Optional[int] = None
-    data: Optional[str] = None
-    strings: Optional[List[str]] = None
-
-    #
-    # detections (skip)
-    #
-    yara: Skip = None
-    cape_yara: Skip = None
-    clamav: Skip = None
-    virustotal: Skip = None
-
-
-class ProcessFile(File):
-    #
-    # like a File, but also has dynamic analysis results
-    #
-    pid: Optional[int] = None
-    process_path: Optional[str] = None
-    process_name: Optional[str] = None
-    module_path: Optional[str] = None
-    virtual_address: Optional[HexInt] = None
-    target_pid: Optional[Union[int, str]] = None
-    target_path: Optional[str] = None
-    target_process: Optional[str] = None
-
-
-class Argument(ExactModel):
-    name: str
-    # unsure why empty list is provided here
-    value: Union[HexInt, int, str, EmptyList]
-    pretty_value: Optional[str] = None
-
-
-class Call(ExactModel):
-    timestamp: str
-    thread_id: int
-    category: str
-
-    api: str
-
-    arguments: List[Argument]
-    status: bool
-    return_: HexInt = Field(alias="return")
-    pretty_return: Optional[str] = None
-
-    repeated: int
-
-    # virtual addresses
-    caller: HexInt
-    parentcaller: HexInt
-
-    # index into calls array
-    id: int
-
-
-class Process(ExactModel):
-    process_id: int
-    process_name: str
-    parent_id: int
-    module_path: str
-    first_seen: str
-    calls: List[Call]
-    threads: List[int]
-    environ: Dict[str, str]
-
-
-class ProcessTree(ExactModel):
-    name: str
-    pid: int
-    parent_id: int
-    module_path: str
-    threads: List[int]
-    environ: Dict[str, str]
-    children: List["ProcessTree"]
-
-
-class Summary(ExactModel):
-    files: List[str]
-    read_files: List[str]
-    write_files: List[str]
-    delete_files: List[str]
-    keys: List[str]
-    read_keys: List[str]
-    write_keys: List[str]
-    delete_keys: List[str]
-    executed_commands: List[str]
-    resolved_apis: List[str]
-    mutexes: List[str]
-    created_services: List[str]
-    started_services: List[str]
-
-
-class EncryptedBuffer(ExactModel):
-    process_name: str
-    pid: int
-
-    api_call: str
-    buffer: str
-    buffer_size: Optional[int] = None
-    crypt_key: Optional[Union[HexInt, str]] = None
-
-
-class Behavior(ExactModel):
-    summary: Summary
-
-    # list of processes, of threads, of calls
-    processes: List[Process]
-    # tree of processes
-    processtree: List[ProcessTree]
-
-    anomaly: List[str]
-    encryptedbuffers: List[EncryptedBuffer]
-    # these are small objects that describe atomic events,
-    # like file move, registery access.
-    # we'll detect the same with our API call analyis.
-    enhanced: Skip = None
-
-
-class Target(ExactModel):
-    category: str
-    file: File
-    pe: Optional[PE] = None
-
-
-class Static(ExactModel):
-    pe: Optional[PE] = None
-    flare_capa: Skip = None
-
-
-class Cape(ExactModel):
-    payloads: List[ProcessFile]
-    configs: Skip = None
-
-
-# flexible because there may be more sorts of analysis
-# but we only care about the ones described here.
-class CapeReport(FlexibleModel):
-    # the input file, I think
-    target: Target
-    # info about the processing job, like machine and distributed metadata.
-    info: Info
-
-    #
-    # static analysis results
-    #
-    static: Optional[Static] = None
-    strings: Optional[List[str]] = None
-
-    #
-    # dynamic analysis results
-    #
-    # post-processed results: process tree, anomalies, etc
-    behavior: Behavior
-
-    # post-processed results: payloads and extracted configs
-    CAPE: Optional[Cape] = None
-    dropped: Optional[List[File]] = None
-    procdump: Optional[List[ProcessFile]] = None
-    procmemory: ListTODO
-
-    # =========================================================================
-    # information we won't use in capa
-    #
-
-    #
-    # NBIs and HBIs
-    # these are super interesting, but they don't enable use to detect behaviors.
-    # they take a lot of code to model and details to maintain.
-    #
-    # if we come up with a future use for this, go ahead and re-enable!
-    #
-    network: Skip = None
-    suricata: Skip = None
-    curtain: Skip = None
-    sysmon: Skip = None
-    url_analysis: Skip = None
-
-    # screenshot hash values
-    deduplicated_shots: Skip = None
-    # k-v pairs describing the time it took to run each stage.
-    statistics: Skip = None
-    # k-v pairs of ATT&CK ID to signature name or similar.
-    ttps: Skip = None
-    # debug log messages
-    debug: Skip = None
-
-    # various signature matches
-    # we could potentially extend capa to use this info one day,
-    # though it would be quite sandbox-specific,
-    # and more detection-oriented than capability detection.
-    signatures: Skip = None
-    malfamily_tag: Optional[str] = None
-    malscore: float
-    detections: Skip = None
-    detections2pid: Optional[Dict[int, List[str]]] = None
-    # AV detections for the sample.
-    virustotal: Skip = None
-
-    @classmethod
-    def from_buf(cls, buf: bytes) -> "CapeReport":
-        return cls.model_validate_json(buf)
--- a/capa/features/extractors/cape/process.py
+++ b/capa/features/extractors/cape/process.py
@@ -1,48 +0,0 @@
-# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
-# Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at: [package root]/LICENSE.txt
-# Unless required by applicable law or agreed to in writing, software distributed under the License
-#  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and limitations under the License.
-
-import logging
-from typing import List, Tuple, Iterator
-
-from capa.features.common import String, Feature
-from capa.features.address import Address, ThreadAddress
-from capa.features.extractors.cape.models import Process
-from capa.features.extractors.base_extractor import ThreadHandle, ProcessHandle
-
-logger = logging.getLogger(__name__)
-
-
-def get_threads(ph: ProcessHandle) -> Iterator[ThreadHandle]:
-    """
-    get the threads associated with a given process
-    """
-    process: Process = ph.inner
-    threads: List[int] = process.threads
-
-    for thread in threads:
-        address: ThreadAddress = ThreadAddress(process=ph.address, tid=thread)
-        yield ThreadHandle(address=address, inner={})
-
-
-def extract_environ_strings(ph: ProcessHandle) -> Iterator[Tuple[Feature, Address]]:
-    """
-    extract strings from a process' provided environment variables.
-    """
-    process: Process = ph.inner
-
-    for value in (value for value in process.environ.values() if value):
-        yield String(value), ph.address
-
-
-def extract_features(ph: ProcessHandle) -> Iterator[Tuple[Feature, Address]]:
-    for handler in PROCESS_HANDLERS:
-        for feature, addr in handler(ph):
-            yield feature, addr
-
-
-PROCESS_HANDLERS = (extract_environ_strings,)
--- a/capa/features/extractors/cape/thread.py
+++ b/capa/features/extractors/cape/thread.py
@@ -1,32 +0,0 @@
-# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
-# Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at: [package root]/LICENSE.txt
-# Unless required by applicable law or agreed to in writing, software distributed under the License
-#  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and limitations under the License.
-
-import logging
-from typing import Iterator
-
-from capa.features.address import DynamicCallAddress
-from capa.features.extractors.helpers import generate_symbols
-from capa.features.extractors.cape.models import Process
-from capa.features.extractors.base_extractor import CallHandle, ThreadHandle, ProcessHandle
-
-logger = logging.getLogger(__name__)
-
-
-def get_calls(ph: ProcessHandle, th: ThreadHandle) -> Iterator[CallHandle]:
-    process: Process = ph.inner
-
-    tid = th.address.tid
-    for call_index, call in enumerate(process.calls):
-        if call.thread_id != tid:
-            continue
-
-        for symbol in generate_symbols("", call.api):
-            call.api = symbol
-
-            addr = DynamicCallAddress(thread=th.address, id=call_index)
-            yield CallHandle(address=addr, inner=call)
--- a/capa/features/extractors/common.py
+++ b/capa/features/extractors/common.py
@@ -6,7 +6,6 @@
 #  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and limitations under the License.
 import io
-import re
 import logging
 import binascii
 import contextlib
@@ -24,11 +23,8 @@ from capa.features.common import (
    OS_AUTO,
    ARCH_ANY,
    FORMAT_PE,
-    FORMAT_DEX,
    FORMAT_ELF,
-    OS_ANDROID,
    OS_WINDOWS,
-    ARCH_DALVIK,
    FORMAT_FREEZE,
    FORMAT_RESULT,
    Arch,
@@ -44,9 +40,7 @@ logger = logging.getLogger(__name__)
 # match strings for formats
 MATCH_PE = b"MZ"
 MATCH_ELF = b"\x7fELF"
-MATCH_DEX = b"dex\n"
 MATCH_RESULT = b'{"meta":'
-MATCH_JSON_OBJECT = b'{"'


 def extract_file_strings(buf, **kwargs) -> Iterator[Tuple[String, Address]]:
@@ -65,17 +59,10 @@ def extract_format(buf) -> Iterator[Tuple[Feature, Address]]:
        yield Format(FORMAT_PE), NO_ADDRESS
    elif buf.startswith(MATCH_ELF):
        yield Format(FORMAT_ELF), NO_ADDRESS
-    elif len(buf) > 8 and buf.startswith(MATCH_DEX) and buf[7] == 0x00:
-        yield Format(FORMAT_DEX), NO_ADDRESS
    elif is_freeze(buf):
        yield Format(FORMAT_FREEZE), NO_ADDRESS
    elif buf.startswith(MATCH_RESULT):
        yield Format(FORMAT_RESULT), NO_ADDRESS
-    elif re.sub(rb"\s", b"", buf[:20]).startswith(MATCH_JSON_OBJECT):
-        # potential start of JSON object data without whitespace
-        # we don't know what it is exactly, but may support it (e.g. a dynamic CAPE sandbox report)
-        # skip verdict here and let subsequent code analyze this further
-        return
    else:
        # we likely end up here:
        #  1. handling a file format (e.g. macho)
@@ -102,9 +89,6 @@ def extract_arch(buf) -> Iterator[Tuple[Feature, Address]]:

        yield Arch(arch), NO_ADDRESS

-    elif len(buf) > 8 and buf.startswith(MATCH_DEX) and buf[7] == 0x00:
-        yield Arch(ARCH_DALVIK), NO_ADDRESS
-
    else:
        # we likely end up here:
        #  1. handling shellcode, or
@@ -138,9 +122,6 @@ def extract_os(buf, os=OS_AUTO) -> Iterator[Tuple[Feature, Address]]:

        yield OS(os), NO_ADDRESS

-    elif len(buf) > 8 and buf.startswith(MATCH_DEX) and buf[7] == 0x00:
-        yield OS(OS_ANDROID), NO_ADDRESS
-
    else:
        # we likely end up here:
        #  1. handling shellcode, or
--- a/capa/features/extractors/dexfile.py
+++ b/capa/features/extractors/dexfile.py
@@ -1,421 +0,0 @@
-# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
-# Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at: [package root]/LICENSE.txt
-# Unless required by applicable law or agreed to in writing, software distributed under the License
-#  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and limitations under the License.
-import struct
-import logging
-from typing import Set, Dict, List, Tuple, Iterator, Optional, TypedDict
-from pathlib import Path
-from dataclasses import dataclass
-
-import dexparser.disassembler as disassembler
-from dexparser import DEXParser, uleb128_value
-
-from capa.features.file import Import, FunctionName
-from capa.features.common import (
-    OS,
-    FORMAT_DEX,
-    OS_ANDROID,
-    ARCH_DALVIK,
-    Arch,
-    Class,
-    Format,
-    String,
-    Feature,
-    Namespace,
-)
-from capa.features.address import NO_ADDRESS, Address, DexClassAddress, DexMethodAddress, FileOffsetAddress
-from capa.features.extractors.base_extractor import (
-    BBHandle,
-    InsnHandle,
-    SampleHashes,
-    FunctionHandle,
-    StaticFeatureExtractor,
-)
-
-logger = logging.getLogger(__name__)
-
-
-# Reference: https://source.android.com/docs/core/runtime/dex-format
-
-
-class DexProtoId(TypedDict):
-    shorty_idx: int
-    return_type_idx: int
-    param_off: int
-
-
-class DexMethodId(TypedDict):
-    class_idx: int
-    proto_idx: int
-    name_idx: int
-
-
-@dataclass
-class DexAnalyzedMethod:
-    class_type: str
-    name: str
-    shorty_descriptor: str
-    return_type: str
-    parameters: List[str]
-    id_offset: int = 0
-    code_offset: int = 0
-    access_flags: Optional[int] = None
-
-    @property
-    def address(self):
-        # NOTE: Some methods do not have code, in that case we use the method_id offset
-        if self.has_code:
-            return self.code_offset
-        else:
-            return self.id_offset
-
-    @property
-    def has_code(self):
-        # NOTE: code_offset is zero if the method is abstract/native or not defined in a class
-        return self.code_offset != 0
-
-    @property
-    def has_definition(self):
-        # NOTE: access_flags is only known if the method is defined in a class
-        return self.access_flags is not None
-
-    @property
-    def qualified_name(self):
-        return f"{self.class_type}::{self.name}"
-
-
-class DexFieldId(TypedDict):
-    class_idx: int
-    type_idx: int
-    name_idx: int
-
-
-class DexClassDef(TypedDict):
-    class_idx: int
-    access_flags: int
-    superclass_idx: int
-    interfaces_off: int
-    source_file_idx: int
-    annotations_off: int
-    class_data_off: int
-    static_values_off: int
-
-
-class DexFieldDef(TypedDict):
-    diff: int
-    access_flags: int
-
-
-class DexMethodDef(TypedDict):
-    diff: int
-    access_flags: int
-    code_off: int
-
-
-class DexClassData(TypedDict):
-    static_fields: List[DexFieldDef]
-    instance_fields: List[DexFieldDef]
-    direct_methods: List[DexMethodDef]
-    virtual_methods: List[DexMethodDef]
-
-
-@dataclass
-class DexAnalyzedClass:
-    offset: int
-    class_type: str
-    superclass_type: str
-    interfaces: List[str]
-    source_file: str
-    data: Optional[DexClassData]
-
-
-class DexAnnotation(TypedDict):
-    visibility: int
-    type_idx_diff: int
-    size_diff: int
-    name_idx_diff: int
-    value_type: int
-    encoded_value: int
-
-
-class DexAnalysis:
-    def get_strings(self):
-        # NOTE: Copied from dexparser, upstream later
-
-        strings: List[Tuple[int, bytes]] = []
-        string_ids_off = self.dex.header_data["string_ids_off"]
-
-        for i in range(self.dex.header_data["string_ids_size"]):
-            offset = struct.unpack("<L", self.dex.data[string_ids_off + (i * 4) : string_ids_off + (i * 4) + 4])[0]
-            c_size, size_offset = uleb128_value(self.dex.data, offset)
-            c_char = self.dex.data[offset + size_offset : offset + size_offset + c_size]
-            strings.append((offset, c_char))
-
-        return strings
-
-    def __init__(self, dex: DEXParser):
-        self.dex = dex
-
-        self.strings = self.get_strings()
-        self.strings_utf8: List[str] = []
-        for _, data in self.strings:
-            # NOTE: This is technically incorrect
-            # Reference: https://source.android.com/devices/tech/dalvik/dex-format#mutf-8
-            self.strings_utf8.append(data.decode("utf-8", errors="backslashreplace"))
-
-        self.type_ids: List[int] = dex.get_typeids()
-        self.method_ids: List[DexMethodId] = dex.get_methods()
-        self.proto_ids: List[DexProtoId] = dex.get_protoids()
-        self.field_ids: List[DexFieldId] = dex.get_fieldids()
-        self.class_defs: List[DexClassDef] = dex.get_classdef_data()
-
-        self._is_analyzing = True
-        self.used_classes: Set[str] = set()
-        self.classes = self._analyze_classes()
-        self.methods = self._analyze_methods()
-        self.methods_by_address: Dict[int, DexAnalyzedMethod] = {m.address: m for m in self.methods}
-
-        self.namespaces: Set[str] = set()
-        for class_type in self.used_classes:
-            idx = class_type.rfind(".")
-            if idx != -1:
-                self.namespaces.add(class_type[:idx])
-
-        for class_type in self.classes:
-            self.used_classes.remove(class_type)
-
-        # Only available after code analysis
-        self._is_analyzing = False
-
-    def analyze_code(self):
-        # Loop over the classes and analyze them
-        # self.classes: List[DexClass] = self.dex.get_class_data(offset=-1)
-        # self.annotations: List[DexAnnotation] = dex.get_annotations(offset=-1)
-        # self.static_values: List[int] = dex.get_static_values(offset=-1)
-        pass
-
-    def get_string(self, index: int) -> str:
-        return self.strings_utf8[index]
-
-    def _decode_descriptor(self, descriptor: str) -> str:
-        first = descriptor[0]
-        if first == "L":
-            pretty = descriptor[1:-1].replace("/", ".")
-            if self._is_analyzing:
-                self.used_classes.add(pretty)
-        elif first == "[":
-            pretty = self._decode_descriptor(descriptor[1:]) + "[]"
-        else:
-            pretty = disassembler.type_descriptor[first]
-        return pretty
-
-    def get_pretty_type(self, index: int) -> str:
-        if index == 0xFFFFFFFF:
-            return "<NO_INDEX>"
-        descriptor = self.get_string(self.type_ids[index])
-        return self._decode_descriptor(descriptor)
-
-    def _analyze_classes(self):
-        classes: Dict[str, DexAnalyzedClass] = {}
-        offset = self.dex.header_data["class_defs_off"]
-        for index, clazz in enumerate(self.class_defs):
-            class_type = self.get_pretty_type(clazz["class_idx"])
-
-            # Superclass
-            superclass_idx = clazz["superclass_idx"]
-            if superclass_idx != 0xFFFFFFFF:
-                superclass_type = self.get_pretty_type(superclass_idx)
-            else:
-                superclass_type = ""
-
-            # Interfaces
-            interfaces = []
-            interfaces_offset = clazz["interfaces_off"]
-            if interfaces_offset != 0:
-                size = struct.unpack("<L", self.dex.data[interfaces_offset : interfaces_offset + 4])[0]
-                for i in range(size):
-                    type_idx = struct.unpack(
-                        "<H", self.dex.data[interfaces_offset + 4 + i * 2 : interfaces_offset + 6 + i * 2]
-                    )[0]
-                    interface_type = self.get_pretty_type(type_idx)
-                    interfaces.append(interface_type)
-
-            # Source file
-            source_file_idx = clazz["source_file_idx"]
-            if source_file_idx != 0xFFFFFFFF:
-                source_file = self.get_string(source_file_idx)
-            else:
-                source_file = ""
-
-            # Data
-            data_offset = clazz["class_data_off"]
-            if data_offset != 0:
-                data = self.dex.get_class_data(data_offset)
-            else:
-                data = None
-
-            classes[class_type] = DexAnalyzedClass(
-                offset=offset + index * 32,
-                class_type=class_type,
-                superclass_type=superclass_type,
-                interfaces=interfaces,
-                source_file=source_file,
-                data=data,
-            )
-        return classes
-
-    def _analyze_methods(self):
-        methods: List[DexAnalyzedMethod] = []
-        for method_id in self.method_ids:
-            proto = self.proto_ids[method_id["proto_idx"]]
-            parameters = []
-
-            param_off = proto["param_off"]
-            if param_off != 0:
-                size = struct.unpack("<L", self.dex.data[param_off : param_off + 4])[0]
-                for i in range(size):
-                    type_idx = struct.unpack("<H", self.dex.data[param_off + 4 + i * 2 : param_off + 6 + i * 2])[0]
-                    param_type = self.get_pretty_type(type_idx)
-                    parameters.append(param_type)
-
-            methods.append(
-                DexAnalyzedMethod(
-                    class_type=self.get_pretty_type(method_id["class_idx"]),
-                    name=self.get_string(method_id["name_idx"]),
-                    shorty_descriptor=self.get_string(proto["shorty_idx"]),
-                    return_type=self.get_pretty_type(proto["return_type_idx"]),
-                    parameters=parameters,
-                )
-            )
-
-        # Fill in the missing method data
-        for clazz in self.classes.values():
-            if clazz.data is None:
-                continue
-
-            for method_def in clazz.data["direct_methods"]:
-                diff = method_def["diff"]
-                methods[diff].access_flags = method_def["access_flags"]
-                methods[diff].code_offset = method_def["code_off"]
-
-            for method_def in clazz.data["virtual_methods"]:
-                diff = method_def["diff"]
-                methods[diff].access_flags = method_def["access_flags"]
-                methods[diff].code_offset = method_def["code_off"]
-
-        # Fill in the missing code offsets with fake data
-        offset = self.dex.header_data["method_ids_off"]
-        for index, method in enumerate(methods):
-            method.id_offset = offset + index * 8
-
-        return methods
-
-    def extract_file_features(self) -> Iterator[Tuple[Feature, Address]]:
-        yield Format(FORMAT_DEX), NO_ADDRESS
-
-        for i in range(len(self.strings)):
-            yield String(self.strings_utf8[i]), FileOffsetAddress(self.strings[i][0])
-
-        for method in self.methods:
-            if method.has_definition:
-                yield FunctionName(method.qualified_name), DexMethodAddress(method.address)
-            else:
-                yield Import(method.qualified_name), DexMethodAddress(method.address)
-
-        for namespace in self.namespaces:
-            yield Namespace(namespace), NO_ADDRESS
-
-        for clazz in self.classes.values():
-            yield Class(clazz.class_type), DexClassAddress(clazz.offset)
-
-        for class_type in self.used_classes:
-            yield Class(class_type), NO_ADDRESS
-
-
-class DexFeatureExtractor(StaticFeatureExtractor):
-    def __init__(self, path: Path, *, code_analysis: bool):
-        super().__init__(hashes=SampleHashes.from_bytes(path.read_bytes()))
-        self.path: Path = path
-        self.code_analysis = code_analysis
-        self.dex = DEXParser(filedir=str(path))
-        self.analysis = DexAnalysis(self.dex)
-
-        # Perform more expensive code analysis only when requested
-        if self.code_analysis:
-            self.analysis.analyze_code()
-
-    def todo(self):
-        import inspect
-
-        message = "[DexparserFeatureExtractor:TODO] " + inspect.stack()[1].function
-        logger.debug(message)
-
-    def get_base_address(self):
-        return NO_ADDRESS
-
-    def extract_global_features(self) -> Iterator[Tuple[Feature, Address]]:
-        # These are hardcoded global features
-        yield Format(FORMAT_DEX), NO_ADDRESS
-        yield OS(OS_ANDROID), NO_ADDRESS
-        yield Arch(ARCH_DALVIK), NO_ADDRESS
-
-    def extract_file_features(self) -> Iterator[Tuple[Feature, Address]]:
-        yield from self.analysis.extract_file_features()
-
-    def is_library_function(self, addr: Address) -> bool:
-        assert isinstance(addr, DexMethodAddress)
-        method = self.analysis.methods_by_address[addr]
-        # exclude androidx/kotlin stuff?
-        return not method.has_definition
-
-    def get_function_name(self, addr: Address) -> str:
-        assert isinstance(addr, DexMethodAddress)
-        method = self.analysis.methods_by_address[addr]
-        return method.qualified_name
-
-    def get_functions(self) -> Iterator[FunctionHandle]:
-        if not self.code_analysis:
-            raise Exception("code analysis is disabled")
-
-        for method in self.analysis.methods:
-            yield FunctionHandle(DexMethodAddress(method.address), method)
-
-    def extract_function_features(self, f: FunctionHandle) -> Iterator[Tuple[Feature, Address]]:
-        if not self.code_analysis:
-            raise Exception("code analysis is disabled")
-        method: DexAnalyzedMethod = f.inner
-        if method.has_code:
-            return self.todo()
-            yield
-
-    def get_basic_blocks(self, f: FunctionHandle) -> Iterator[BBHandle]:
-        if not self.code_analysis:
-            raise Exception("code analysis is disabled")
-        method: DexAnalyzedMethod = f.inner
-        if method.has_code:
-            return self.todo()
-            yield
-
-    def extract_basic_block_features(self, f: FunctionHandle, bb: BBHandle) -> Iterator[Tuple[Feature, Address]]:
-        if not self.code_analysis:
-            raise Exception("code analysis is disabled")
-        return self.todo()
-        yield
-
-    def get_instructions(self, f: FunctionHandle, bb: BBHandle) -> Iterator[InsnHandle]:
-        if not self.code_analysis:
-            raise Exception("code analysis is disabled")
-        return self.todo()
-        yield
-
-    def extract_insn_features(
-        self, f: FunctionHandle, bb: BBHandle, insn: InsnHandle
-    ) -> Iterator[Tuple[Feature, Address]]:
-        if not self.code_analysis:
-            raise Exception("code analysis is disabled")
-        return self.todo()
-        yield
--- a/capa/features/extractors/dnfile/extractor.py
+++ b/capa/features/extractors/dnfile/extractor.py
@@ -22,13 +22,7 @@ import capa.features.extractors.dnfile.function
 from capa.features.common import Feature
 from capa.features.address import NO_ADDRESS, Address, DNTokenAddress, DNTokenOffsetAddress
 from capa.features.extractors.dnfile.types import DnType, DnUnmanagedMethod
-from capa.features.extractors.base_extractor import (
-    BBHandle,
-    InsnHandle,
-    SampleHashes,
-    FunctionHandle,
-    StaticFeatureExtractor,
-)
+from capa.features.extractors.base_extractor import BBHandle, InsnHandle, FunctionHandle, FeatureExtractor
 from capa.features.extractors.dnfile.helpers import (
    get_dotnet_types,
    get_dotnet_fields,
@@ -74,10 +68,10 @@ class DnFileFeatureExtractorCache:
        return self.types.get(token)


-class DnfileFeatureExtractor(StaticFeatureExtractor):
+class DnfileFeatureExtractor(FeatureExtractor):
    def __init__(self, path: Path):
+        super().__init__()
        self.pe: dnfile.dnPE = dnfile.dnPE(str(path))
-        super().__init__(hashes=SampleHashes.from_bytes(path.read_bytes()))

        # pre-compute .NET token lookup tables; each .NET method has access to this cache for feature extraction
        # most relevant at instruction scope
--- a/capa/features/extractors/dnfile_.py
+++ b/capa/features/extractors/dnfile_.py
@@ -0,0 +1,158 @@
+# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
+# Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at: [package root]/LICENSE.txt
+# Unless required by applicable law or agreed to in writing, software distributed under the License
+#  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and limitations under the License.
+import logging
+from typing import Tuple, Iterator
+from pathlib import Path
+
+import dnfile
+import pefile
+
+from capa.features.common import (
+    OS,
+    OS_ANY,
+    ARCH_ANY,
+    ARCH_I386,
+    FORMAT_PE,
+    ARCH_AMD64,
+    FORMAT_DOTNET,
+    Arch,
+    Format,
+    Feature,
+)
+from capa.features.address import NO_ADDRESS, Address, AbsoluteVirtualAddress
+from capa.features.extractors.base_extractor import FeatureExtractor
+
+logger = logging.getLogger(__name__)
+
+
+def extract_file_format(**kwargs) -> Iterator[Tuple[Feature, Address]]:
+    yield Format(FORMAT_PE), NO_ADDRESS
+    yield Format(FORMAT_DOTNET), NO_ADDRESS
+
+
+def extract_file_os(**kwargs) -> Iterator[Tuple[Feature, Address]]:
+    yield OS(OS_ANY), NO_ADDRESS
+
+
+def extract_file_arch(pe: dnfile.dnPE, **kwargs) -> Iterator[Tuple[Feature, Address]]:
+    # to distinguish in more detail, see https://stackoverflow.com/a/23614024/10548020
+    # .NET 4.5 added option: any CPU, 32-bit preferred
+    assert pe.net is not None
+    assert pe.net.Flags is not None
+
+    if pe.net.Flags.CLR_32BITREQUIRED and pe.PE_TYPE == pefile.OPTIONAL_HEADER_MAGIC_PE:
+        yield Arch(ARCH_I386), NO_ADDRESS
+    elif not pe.net.Flags.CLR_32BITREQUIRED and pe.PE_TYPE == pefile.OPTIONAL_HEADER_MAGIC_PE_PLUS:
+        yield Arch(ARCH_AMD64), NO_ADDRESS
+    else:
+        yield Arch(ARCH_ANY), NO_ADDRESS
+
+
+def extract_file_features(pe: dnfile.dnPE) -> Iterator[Tuple[Feature, Address]]:
+    for file_handler in FILE_HANDLERS:
+        for feature, address in file_handler(pe=pe):  # type: ignore
+            yield feature, address
+
+
+FILE_HANDLERS = (
+    # extract_file_export_names,
+    # extract_file_import_names,
+    # extract_file_section_names,
+    # extract_file_strings,
+    # extract_file_function_names,
+    extract_file_format,
+)
+
+
+def extract_global_features(pe: dnfile.dnPE) -> Iterator[Tuple[Feature, Address]]:
+    for handler in GLOBAL_HANDLERS:
+        for feature, addr in handler(pe=pe):  # type: ignore
+            yield feature, addr
+
+
+GLOBAL_HANDLERS = (
+    extract_file_os,
+    extract_file_arch,
+)
+
+
+class DnfileFeatureExtractor(FeatureExtractor):
+    def __init__(self, path: Path):
+        super().__init__()
+        self.path: Path = path
+        self.pe: dnfile.dnPE = dnfile.dnPE(str(path))
+
+    def get_base_address(self) -> AbsoluteVirtualAddress:
+        return AbsoluteVirtualAddress(0x0)
+
+    def get_entry_point(self) -> int:
+        # self.pe.net.Flags.CLT_NATIVE_ENTRYPOINT
+        #  True: native EP: Token
+        #  False: managed EP: RVA
+        assert self.pe.net is not None
+        assert self.pe.net.struct is not None
+
+        return self.pe.net.struct.EntryPointTokenOrRva
+
+    def extract_global_features(self):
+        yield from extract_global_features(self.pe)
+
+    def extract_file_features(self):
+        yield from extract_file_features(self.pe)
+
+    def is_dotnet_file(self) -> bool:
+        return bool(self.pe.net)
+
+    def is_mixed_mode(self) -> bool:
+        assert self.pe is not None
+        assert self.pe.net is not None
+        assert self.pe.net.Flags is not None
+
+        return not bool(self.pe.net.Flags.CLR_ILONLY)
+
+    def get_runtime_version(self) -> Tuple[int, int]:
+        assert self.pe is not None
+        assert self.pe.net is not None
+        assert self.pe.net.struct is not None
+
+        return self.pe.net.struct.MajorRuntimeVersion, self.pe.net.struct.MinorRuntimeVersion
+
+    def get_meta_version_string(self) -> str:
+        assert self.pe.net is not None
+        assert self.pe.net.metadata is not None
+        assert self.pe.net.metadata.struct is not None
+        assert self.pe.net.metadata.struct.Version is not None
+
+        vbuf = self.pe.net.metadata.struct.Version
+        assert isinstance(vbuf, bytes)
+
+        return vbuf.rstrip(b"\x00").decode("utf-8")
+
+    def get_functions(self):
+        raise NotImplementedError("DnfileFeatureExtractor can only be used to extract file features")
+
+    def extract_function_features(self, f):
+        raise NotImplementedError("DnfileFeatureExtractor can only be used to extract file features")
+
+    def get_basic_blocks(self, f):
+        raise NotImplementedError("DnfileFeatureExtractor can only be used to extract file features")
+
+    def extract_basic_block_features(self, f, bb):
+        raise NotImplementedError("DnfileFeatureExtractor can only be used to extract file features")
+
+    def get_instructions(self, f, bb):
+        raise NotImplementedError("DnfileFeatureExtractor can only be used to extract file features")
+
+    def extract_insn_features(self, f, bb, insn):
+        raise NotImplementedError("DnfileFeatureExtractor can only be used to extract file features")
+
+    def is_library_function(self, va):
+        raise NotImplementedError("DnfileFeatureExtractor can only be used to extract file features")
+
+    def get_function_name(self, va):
+        raise NotImplementedError("DnfileFeatureExtractor can only be used to extract file features")
--- a/capa/features/extractors/dotnetfile.py
+++ b/capa/features/extractors/dotnetfile.py
@@ -31,9 +31,9 @@ from capa.features.common import (
    Characteristic,
 )
 from capa.features.address import NO_ADDRESS, Address, DNTokenAddress
-from capa.features.extractors.dnfile.types import DnType
-from capa.features.extractors.base_extractor import SampleHashes, StaticFeatureExtractor
+from capa.features.extractors.base_extractor import FeatureExtractor
 from capa.features.extractors.dnfile.helpers import (
+    DnType,
    iter_dotnet_table,
    is_dotnet_mixed_mode,
    get_dotnet_managed_imports,
@@ -57,7 +57,7 @@ def extract_file_import_names(pe: dnfile.dnPE, **kwargs) -> Iterator[Tuple[Impor

    for imp in get_dotnet_unmanaged_imports(pe):
        # like kernel32.CreateFileA
-        for name in capa.features.extractors.helpers.generate_symbols(imp.module, imp.method, include_dll=True):
+        for name in capa.features.extractors.helpers.generate_symbols(imp.module, imp.method):
            yield Import(name), DNTokenAddress(imp.token)


@@ -165,9 +165,9 @@ GLOBAL_HANDLERS = (
 )


-class DotnetFileFeatureExtractor(StaticFeatureExtractor):
+class DotnetFileFeatureExtractor(FeatureExtractor):
    def __init__(self, path: Path):
-        super().__init__(hashes=SampleHashes.from_bytes(path.read_bytes()))
+        super().__init__()
        self.path: Path = path
        self.pe: dnfile.dnPE = dnfile.dnPE(str(path))

--- a/capa/features/extractors/elf.py
+++ b/capa/features/extractors/elf.py
@@ -13,8 +13,6 @@ from enum import Enum
 from typing import Set, Dict, List, Tuple, BinaryIO, Iterator, Optional
 from dataclasses import dataclass

-import Elf  # from vivisect
-
 logger = logging.getLogger(__name__)


@@ -56,7 +54,6 @@ class OS(str, Enum):
    CLOUD = "cloud"
    SYLLABLE = "syllable"
    NACL = "nacl"
-    ANDROID = "android"


 # via readelf: https://github.com/bminor/binutils-gdb/blob/c0e94211e1ac05049a4ce7c192c9d14d1764eb3e/binutils/readelf.c#L19635-L19658
@@ -712,17 +709,17 @@ class SymTab:
        yield from self.symbols

    @classmethod
-    def from_viv(cls, elf: Elf.Elf) -> Optional["SymTab"]:
-        endian = "<" if elf.getEndian() == 0 else ">"
-        bitness = elf.bits
+    def from_Elf(cls, ElfBinary) -> Optional["SymTab"]:
+        endian = "<" if ElfBinary.getEndian() == 0 else ">"
+        bitness = ElfBinary.bits

        SHT_SYMTAB = 0x2
-        for section in elf.sections:
-            if section.sh_type == SHT_SYMTAB:
-                strtab_section = elf.sections[section.sh_link]
-                sh_symtab = Shdr.from_viv(section, elf.readAtOffset(section.sh_offset, section.sh_size))
+        for section in ElfBinary.sections:
+            if section.sh_info & SHT_SYMTAB:
+                strtab_section = ElfBinary.sections[section.sh_link]
+                sh_symtab = Shdr.from_viv(section, ElfBinary.readAtOffset(section.sh_offset, section.sh_size))
                sh_strtab = Shdr.from_viv(
-                    strtab_section, elf.readAtOffset(strtab_section.sh_offset, strtab_section.sh_size)
+                    strtab_section, ElfBinary.readAtOffset(strtab_section.sh_offset, strtab_section.sh_size)
                )

        try:
@@ -767,11 +764,6 @@ def guess_os_from_ph_notes(elf: ELF) -> Optional[OS]:
        elif note.name == "FreeBSD":
            logger.debug("note owner: %s", "FREEBSD")
            return OS.FREEBSD
-        elif note.name == "Android":
-            logger.debug("note owner: %s", "Android")
-            # see the following for parsing the structure:
-            # https://android.googlesource.com/platform/ndk/+/master/parse_elfnote.py
-            return OS.ANDROID
        elif note.name == "GNU":
            abi_tag = note.abi_tag
            if abi_tag:
@@ -863,8 +855,6 @@ def guess_os_from_needed_dependencies(elf: ELF) -> Optional[OS]:
            return OS.HURD
        if needed.startswith("libhurduser.so"):
            return OS.HURD
-        if needed.startswith("libandroid.so"):
-            return OS.ANDROID

    return None

@@ -898,7 +888,7 @@ def guess_os_from_symtab(elf: ELF) -> Optional[OS]:

 def detect_elf_os(f) -> str:
    """
-    f: type Union[BinaryIO, IDAIO, GHIDRAIO]
+    f: type Union[BinaryIO, IDAIO]
    """
    try:
        elf = ELF(f)
--- a/capa/features/extractors/elffile.py
+++ b/capa/features/extractors/elffile.py
@@ -11,19 +11,21 @@ from typing import Tuple, Iterator
 from pathlib import Path

 from elftools.elf.elffile import ELFFile, SymbolTableSection
-from elftools.elf.relocation import RelocationSection

 import capa.features.extractors.common
-from capa.features.file import Export, Import, Section
+from capa.features.file import Import, Section
 from capa.features.common import OS, FORMAT_ELF, Arch, Format, Feature
 from capa.features.address import NO_ADDRESS, FileOffsetAddress, AbsoluteVirtualAddress
-from capa.features.extractors.base_extractor import SampleHashes, StaticFeatureExtractor
+from capa.features.extractors.base_extractor import FeatureExtractor

 logger = logging.getLogger(__name__)


-def extract_file_export_names(elf: ELFFile, **kwargs):
-    for section in elf.iter_sections():
+def extract_file_import_names(elf, **kwargs):
+    # see https://github.com/eliben/pyelftools/blob/0664de05ed2db3d39041e2d51d19622a8ef4fb0f/scripts/readelf.py#L372
+    symbol_tables = [(idx, s) for idx, s in enumerate(elf.iter_sections()) if isinstance(s, SymbolTableSection)]
+
+    for _, section in symbol_tables:
        if not isinstance(section, SymbolTableSection):
            continue

@@ -33,64 +35,14 @@ def extract_file_export_names(elf: ELFFile, **kwargs):

        logger.debug("Symbol table '%s' contains %s entries:", section.name, section.num_symbols())

-        for symbol in section.iter_symbols():
-            # The following conditions are based on the following article
-            # http://www.m4b.io/elf/export/binary/analysis/2015/05/25/what-is-an-elf-export.html
-            if not symbol.name:
-                continue
-            if symbol.entry.st_info.type not in ["STT_FUNC", "STT_OBJECT", "STT_IFUNC"]:
-                continue
-            if symbol.entry.st_value == 0:
-                continue
-            if symbol.entry.st_shndx == "SHN_UNDEF":
-                continue
-
-            yield Export(symbol.name), AbsoluteVirtualAddress(symbol.entry.st_value)
-
-
-def extract_file_import_names(elf: ELFFile, **kwargs):
-    # Create a dictionary to store symbol names by their index
-    symbol_names = {}
-
-    # Extract symbol names and store them in the dictionary
-    for section in elf.iter_sections():
-        if not isinstance(section, SymbolTableSection):
-            continue
-
        for _, symbol in enumerate(section.iter_symbols()):
-            # The following conditions are based on the following article
-            # http://www.m4b.io/elf/export/binary/analysis/2015/05/25/what-is-an-elf-export.html
-            if not symbol.name:
-                continue
-            if symbol.entry.st_info.type not in ["STT_FUNC", "STT_OBJECT", "STT_IFUNC"]:
-                continue
-            if symbol.entry.st_value != 0:
-                continue
-            if symbol.entry.st_shndx != "SHN_UNDEF":
-                continue
-            if symbol.entry.st_name == 0:
-                continue
-
-            symbol_names[_] = symbol.name
-
-    for section in elf.iter_sections():
-        if not isinstance(section, RelocationSection):
-            continue
-
-        if section["sh_entsize"] == 0:
-            logger.debug("Symbol table '%s' has a sh_entsize of zero!", section.name)
-            continue
-
-        logger.debug("Symbol table '%s' contains %s entries:", section.name, section.num_relocations())
-
-        for relocation in section.iter_relocations():
-            # Extract the symbol name from the symbol table using the symbol index in the relocation
-            if relocation["r_info_sym"] not in symbol_names:
-                continue
-            yield Import(symbol_names[relocation["r_info_sym"]]), FileOffsetAddress(relocation["r_offset"])
+            if symbol.name and symbol.entry.st_info.type == "STT_FUNC":
+                # TODO(williballenthin): extract symbol address
+                # https://github.com/mandiant/capa/issues/1608
+                yield Import(symbol.name), FileOffsetAddress(0x0)


-def extract_file_section_names(elf: ELFFile, **kwargs):
+def extract_file_section_names(elf, **kwargs):
    for section in elf.iter_sections():
        if section.name:
            yield Section(section.name), AbsoluteVirtualAddress(section.header.sh_addr)
@@ -102,7 +54,7 @@ def extract_file_strings(buf, **kwargs):
    yield from capa.features.extractors.common.extract_file_strings(buf)


-def extract_file_os(elf: ELFFile, buf, **kwargs):
+def extract_file_os(elf, buf, **kwargs):
    # our current approach does not always get an OS value, e.g. for packed samples
    # for file limitation purposes, we're more lax here
    try:
@@ -116,7 +68,7 @@ def extract_file_format(**kwargs):
    yield Format(FORMAT_ELF), NO_ADDRESS


-def extract_file_arch(elf: ELFFile, **kwargs):
+def extract_file_arch(elf, **kwargs):
    arch = elf.get_machine_arch()
    if arch == "x86":
        yield Arch("i386"), NO_ADDRESS
@@ -133,7 +85,8 @@ def extract_file_features(elf: ELFFile, buf: bytes) -> Iterator[Tuple[Feature, i


 FILE_HANDLERS = (
-    extract_file_export_names,
+    # TODO(williballenthin): implement extract_file_export_names
+    # https://github.com/mandiant/capa/issues/1607
    extract_file_import_names,
    extract_file_section_names,
    extract_file_strings,
@@ -154,9 +107,9 @@ GLOBAL_HANDLERS = (
 )


-class ElfFeatureExtractor(StaticFeatureExtractor):
+class ElfFeatureExtractor(FeatureExtractor):
    def __init__(self, path: Path):
-        super().__init__(SampleHashes.from_bytes(path.read_bytes()))
+        super().__init__()
        self.path: Path = path
        self.elf = ELFFile(io.BytesIO(path.read_bytes()))

--- a/capa/features/extractors/ghidra/init.py
+++ b/capa/features/extractors/ghidra/init.py
--- a/capa/features/extractors/ghidra/basicblock.py
+++ b/capa/features/extractors/ghidra/basicblock.py
@@ -1,152 +0,0 @@
-# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
-# Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at: [package root]/LICENSE.txt
-# Unless required by applicable law or agreed to in writing, software distributed under the License
-#  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and limitations under the License.
-
-import string
-import struct
-from typing import Tuple, Iterator
-
-import ghidra
-from ghidra.program.model.lang import OperandType
-
-import capa.features.extractors.ghidra.helpers
-from capa.features.common import Feature, Characteristic
-from capa.features.address import Address
-from capa.features.basicblock import BasicBlock
-from capa.features.extractors.helpers import MIN_STACKSTRING_LEN
-from capa.features.extractors.base_extractor import BBHandle, FunctionHandle
-
-
-def get_printable_len(op: ghidra.program.model.scalar.Scalar) -> int:
-    """Return string length if all operand bytes are ascii or utf16-le printable"""
-    op_bit_len = op.bitLength()
-    op_byte_len = op_bit_len // 8
-    op_val = op.getValue()
-
-    if op_bit_len == 8:
-        chars = struct.pack("<B", op_val & 0xFF)
-    elif op_bit_len == 16:
-        chars = struct.pack("<H", op_val & 0xFFFF)
-    elif op_bit_len == 32:
-        chars = struct.pack("<I", op_val & 0xFFFFFFFF)
-    elif op_bit_len == 64:
-        chars = struct.pack("<Q", op_val & 0xFFFFFFFFFFFFFFFF)
-    else:
-        raise ValueError(f"Unhandled operand data type 0x{op_bit_len:x}.")
-
-    def is_printable_ascii(chars_: bytes):
-        return all(c < 127 and chr(c) in string.printable for c in chars_)
-
-    def is_printable_utf16le(chars_: bytes):
-        if all(c == 0x00 for c in chars_[1::2]):
-            return is_printable_ascii(chars_[::2])
-
-    if is_printable_ascii(chars):
-        return op_byte_len
-
-    if is_printable_utf16le(chars):
-        return op_byte_len
-
-    return 0
-
-
-def is_mov_imm_to_stack(insn: ghidra.program.database.code.InstructionDB) -> bool:
-    """verify instruction moves immediate onto stack"""
-
-    # Ghidra will Bitwise OR the OperandTypes to assign multiple
-    # i.e., the first operand is a stackvar (dynamically allocated),
-    # and the second is a scalar value (single int/char/float/etc.)
-    mov_its_ops = [(OperandType.ADDRESS | OperandType.DYNAMIC), OperandType.SCALAR]
-    found = False
-
-    # MOV dword ptr [EBP + local_*], 0x65
-    if insn.getMnemonicString().startswith("MOV"):
-        found = all(insn.getOperandType(i) == mov_its_ops[i] for i in range(2))
-
-    return found
-
-
-def bb_contains_stackstring(bb: ghidra.program.model.block.CodeBlock) -> bool:
-    """check basic block for stackstring indicators
-
-    true if basic block contains enough moves of constant bytes to the stack
-    """
-    count = 0
-    for insn in currentProgram().getListing().getInstructions(bb, True):  # type: ignore [name-defined] # noqa: F821
-        if is_mov_imm_to_stack(insn):
-            count += get_printable_len(insn.getScalar(1))
-        if count > MIN_STACKSTRING_LEN:
-            return True
-    return False
-
-
-def _bb_has_tight_loop(bb: ghidra.program.model.block.CodeBlock):
-    """
-    parse tight loops, true if last instruction in basic block branches to bb start
-    """
-    # Reverse Ordered, first InstructionDB
-    last_insn = currentProgram().getListing().getInstructions(bb, False).next()  # type: ignore [name-defined] # noqa: F821
-
-    if last_insn.getFlowType().isJump():
-        return last_insn.getAddress(0) == bb.getMinAddress()
-
-    return False
-
-
-def extract_bb_stackstring(fh: FunctionHandle, bbh: BBHandle) -> Iterator[Tuple[Feature, Address]]:
-    """extract stackstring indicators from basic block"""
-    bb: ghidra.program.model.block.CodeBlock = bbh.inner
-
-    if bb_contains_stackstring(bb):
-        yield Characteristic("stack string"), bbh.address
-
-
-def extract_bb_tight_loop(fh: FunctionHandle, bbh: BBHandle) -> Iterator[Tuple[Feature, Address]]:
-    """check basic block for tight loop indicators"""
-    bb: ghidra.program.model.block.CodeBlock = bbh.inner
-
-    if _bb_has_tight_loop(bb):
-        yield Characteristic("tight loop"), bbh.address
-
-
-BASIC_BLOCK_HANDLERS = (
-    extract_bb_tight_loop,
-    extract_bb_stackstring,
-)
-
-
-def extract_features(fh: FunctionHandle, bbh: BBHandle) -> Iterator[Tuple[Feature, Address]]:
-    """
-    extract features from the given basic block.
-
-    args:
-        bb: the basic block to process.
-
-    yields:
-      Tuple[Feature, int]: the features and their location found in this basic block.
-    """
-    yield BasicBlock(), bbh.address
-    for bb_handler in BASIC_BLOCK_HANDLERS:
-        for feature, addr in bb_handler(fh, bbh):
-            yield feature, addr
-
-
-def main():
-    features = []
-    from capa.features.extractors.ghidra.extractor import GhidraFeatureExtractor
-
-    for fh in GhidraFeatureExtractor().get_functions():
-        for bbh in capa.features.extractors.ghidra.helpers.get_function_blocks(fh):
-            features.extend(list(extract_features(fh, bbh)))
-
-    import pprint
-
-    pprint.pprint(features)  # noqa: T203
-
-
-if __name__ == "__main__":
-    main()
--- a/capa/features/extractors/ghidra/extractor.py
+++ b/capa/features/extractors/ghidra/extractor.py
@@ -1,93 +0,0 @@
-# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
-# Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at: [package root]/LICENSE.txt
-# Unless required by applicable law or agreed to in writing, software distributed under the License
-#  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and limitations under the License.
-from typing import List, Tuple, Iterator
-
-import capa.features.extractors.ghidra.file
-import capa.features.extractors.ghidra.insn
-import capa.features.extractors.ghidra.global_
-import capa.features.extractors.ghidra.function
-import capa.features.extractors.ghidra.basicblock
-from capa.features.common import Feature
-from capa.features.address import Address, AbsoluteVirtualAddress
-from capa.features.extractors.base_extractor import (
-    BBHandle,
-    InsnHandle,
-    SampleHashes,
-    FunctionHandle,
-    StaticFeatureExtractor,
-)
-
-
-class GhidraFeatureExtractor(StaticFeatureExtractor):
-    def __init__(self):
-        import capa.features.extractors.ghidra.helpers as ghidra_helpers
-
-        super().__init__(
-            SampleHashes(
-                md5=capa.ghidra.helpers.get_file_md5(),
-                # ghidra doesn't expose this hash.
-                # https://ghidra.re/ghidra_docs/api/ghidra/program/model/listing/Program.html
-                #
-                # the hashes are stored in the database, not computed on the fly,
-                # so its probably not trivial to add SHA1.
-                sha1="",
-                sha256=capa.ghidra.helpers.get_file_sha256(),
-            )
-        )
-
-        self.global_features: List[Tuple[Feature, Address]] = []
-        self.global_features.extend(capa.features.extractors.ghidra.file.extract_file_format())
-        self.global_features.extend(capa.features.extractors.ghidra.global_.extract_os())
-        self.global_features.extend(capa.features.extractors.ghidra.global_.extract_arch())
-        self.imports = ghidra_helpers.get_file_imports()
-        self.externs = ghidra_helpers.get_file_externs()
-        self.fakes = ghidra_helpers.map_fake_import_addrs()
-
-    def get_base_address(self):
-        return AbsoluteVirtualAddress(currentProgram().getImageBase().getOffset())  # type: ignore [name-defined] # noqa: F821
-
-    def extract_global_features(self):
-        yield from self.global_features
-
-    def extract_file_features(self):
-        yield from capa.features.extractors.ghidra.file.extract_features()
-
-    def get_functions(self) -> Iterator[FunctionHandle]:
-        import capa.features.extractors.ghidra.helpers as ghidra_helpers
-
-        for fhandle in ghidra_helpers.get_function_symbols():
-            fh: FunctionHandle = FunctionHandle(
-                address=AbsoluteVirtualAddress(fhandle.getEntryPoint().getOffset()),
-                inner=fhandle,
-                ctx={"imports_cache": self.imports, "externs_cache": self.externs, "fakes_cache": self.fakes},
-            )
-            yield fh
-
-    @staticmethod
-    def get_function(addr: int) -> FunctionHandle:
-        func = getFunctionContaining(toAddr(addr))  # type: ignore [name-defined] # noqa: F821
-        return FunctionHandle(address=AbsoluteVirtualAddress(func.getEntryPoint().getOffset()), inner=func)
-
-    def extract_function_features(self, fh: FunctionHandle) -> Iterator[Tuple[Feature, Address]]:
-        yield from capa.features.extractors.ghidra.function.extract_features(fh)
-
-    def get_basic_blocks(self, fh: FunctionHandle) -> Iterator[BBHandle]:
-        import capa.features.extractors.ghidra.helpers as ghidra_helpers
-
-        yield from ghidra_helpers.get_function_blocks(fh)
-
-    def extract_basic_block_features(self, fh: FunctionHandle, bbh: BBHandle) -> Iterator[Tuple[Feature, Address]]:
-        yield from capa.features.extractors.ghidra.basicblock.extract_features(fh, bbh)
-
-    def get_instructions(self, fh: FunctionHandle, bbh: BBHandle) -> Iterator[InsnHandle]:
-        import capa.features.extractors.ghidra.helpers as ghidra_helpers
-
-        yield from ghidra_helpers.get_insn_in_range(bbh)
-
-    def extract_insn_features(self, fh: FunctionHandle, bbh: BBHandle, ih: InsnHandle):
-        yield from capa.features.extractors.ghidra.insn.extract_features(fh, bbh, ih)
--- a/capa/features/extractors/ghidra/file.py
+++ b/capa/features/extractors/ghidra/file.py
@@ -1,202 +0,0 @@
-# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
-# Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at: [package root]/LICENSE.txt
-# Unless required by applicable law or agreed to in writing, software distributed under the License
-#  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and limitations under the License.
-import re
-import struct
-from typing import List, Tuple, Iterator
-
-from ghidra.program.model.symbol import SourceType, SymbolType
-
-import capa.features.extractors.common
-import capa.features.extractors.helpers
-import capa.features.extractors.strings
-import capa.features.extractors.ghidra.helpers
-from capa.features.file import Export, Import, Section, FunctionName
-from capa.features.common import FORMAT_PE, FORMAT_ELF, Format, String, Feature, Characteristic
-from capa.features.address import NO_ADDRESS, Address, FileOffsetAddress, AbsoluteVirtualAddress
-
-MAX_OFFSET_PE_AFTER_MZ = 0x200
-
-
-def find_embedded_pe(block_bytez: bytes, mz_xor: List[Tuple[bytes, bytes, int]]) -> Iterator[Tuple[int, int]]:
-    """check segment for embedded PE
-
-    adapted for Ghidra from:
-    https://github.com/vivisect/vivisect/blob/91e8419a861f4977https://github.com/vivisect/vivisect/blob/91e8419a861f49779f18316f155311967e696836/PE/carve.py#L259f18316f155311967e696836/PE/carve.py#L25
-    """
-    todo = []
-
-    for mzx, pex, i in mz_xor:
-        for match in re.finditer(re.escape(mzx), block_bytez):
-            todo.append((match.start(), mzx, pex, i))
-
-    seg_max = len(block_bytez)  # noqa: F821
-    while len(todo):
-        off, mzx, pex, i = todo.pop()
-
-        # MZ header has one field we will check e_lfanew is at 0x3c
-        e_lfanew = off + 0x3C
-
-        if seg_max < e_lfanew + 4:
-            continue
-
-        e_lfanew_bytes = block_bytez[e_lfanew : e_lfanew + 4]
-        newoff = struct.unpack("<I", capa.features.extractors.helpers.xor_static(e_lfanew_bytes, i))[0]
-
-        # assume XOR'd "PE" bytes exist within threshold
-        if newoff > MAX_OFFSET_PE_AFTER_MZ:
-            continue
-
-        peoff = off + newoff
-        if seg_max < peoff + 2:
-            continue
-
-        pe_bytes = block_bytez[peoff : peoff + 2]
-        if pe_bytes == pex:
-            yield off, i
-
-
-def extract_file_embedded_pe() -> Iterator[Tuple[Feature, Address]]:
-    """extract embedded PE features"""
-
-    # pre-compute XOR pairs
-    mz_xor: List[Tuple[bytes, bytes, int]] = [
-        (
-            capa.features.extractors.helpers.xor_static(b"MZ", i),
-            capa.features.extractors.helpers.xor_static(b"PE", i),
-            i,
-        )
-        for i in range(256)
-    ]
-
-    for block in currentProgram().getMemory().getBlocks():  # type: ignore [name-defined] # noqa: F821
-        if not all((block.isLoaded(), block.isInitialized(), "Headers" not in block.getName())):
-            continue
-
-        for off, _ in find_embedded_pe(capa.features.extractors.ghidra.helpers.get_block_bytes(block), mz_xor):
-            # add offset back to block start
-            ea: int = block.getStart().add(off).getOffset()
-
-            yield Characteristic("embedded pe"), FileOffsetAddress(ea)
-
-
-def extract_file_export_names() -> Iterator[Tuple[Feature, Address]]:
-    """extract function exports"""
-    st = currentProgram().getSymbolTable()  # type: ignore [name-defined] # noqa: F821
-    for addr in st.getExternalEntryPointIterator():
-        yield Export(st.getPrimarySymbol(addr).getName()), AbsoluteVirtualAddress(addr.getOffset())
-
-
-def extract_file_import_names() -> Iterator[Tuple[Feature, Address]]:
-    """extract function imports
-
-    1. imports by ordinal:
-     - modulename.#ordinal
-
-    2. imports by name, results in two features to support importname-only
-       matching:
-     - modulename.importname
-     - importname
-    """
-
-    for f in currentProgram().getFunctionManager().getExternalFunctions():  # type: ignore [name-defined] # noqa: F821
-        for r in f.getSymbol().getReferences():
-            if r.getReferenceType().isData():
-                addr = r.getFromAddress().getOffset()  # gets pointer to fake external addr
-
-        fstr = f.toString().split("::")  # format: MODULE.dll::import / MODULE::Ordinal_*
-        if "Ordinal_" in fstr[1]:
-            fstr[1] = f"#{fstr[1].split('_')[1]}"
-
-        for name in capa.features.extractors.helpers.generate_symbols(fstr[0][:-4], fstr[1], include_dll=True):
-            yield Import(name), AbsoluteVirtualAddress(addr)
-
-
-def extract_file_section_names() -> Iterator[Tuple[Feature, Address]]:
-    """extract section names"""
-
-    for block in currentProgram().getMemory().getBlocks():  # type: ignore [name-defined] # noqa: F821
-        yield Section(block.getName()), AbsoluteVirtualAddress(block.getStart().getOffset())
-
-
-def extract_file_strings() -> Iterator[Tuple[Feature, Address]]:
-    """extract ASCII and UTF-16 LE strings"""
-
-    for block in currentProgram().getMemory().getBlocks():  # type: ignore [name-defined] # noqa: F821
-        if block.isInitialized():
-            p_bytes = capa.features.extractors.ghidra.helpers.get_block_bytes(block)
-
-        for s in capa.features.extractors.strings.extract_ascii_strings(p_bytes):
-            offset = block.getStart().getOffset() + s.offset
-            yield String(s.s), FileOffsetAddress(offset)
-
-        for s in capa.features.extractors.strings.extract_unicode_strings(p_bytes):
-            offset = block.getStart().getOffset() + s.offset
-            yield String(s.s), FileOffsetAddress(offset)
-
-
-def extract_file_function_names() -> Iterator[Tuple[Feature, Address]]:
-    """
-    extract the names of statically-linked library functions.
-    """
-
-    for sym in currentProgram().getSymbolTable().getAllSymbols(True):  # type: ignore [name-defined] # noqa: F821
-        # .isExternal() misses more than this config for the function symbols
-        if sym.getSymbolType() == SymbolType.FUNCTION and sym.getSource() == SourceType.ANALYSIS and sym.isGlobal():
-            name = sym.getName()  # starts to resolve names based on Ghidra's FidDB
-            if name.startswith("FID_conflict:"):  # format: FID_conflict:<function-name>
-                name = name[13:]
-            addr = AbsoluteVirtualAddress(sym.getAddress().getOffset())
-            yield FunctionName(name), addr
-            if name.startswith("_"):
-                # some linkers may prefix linked routines with a `_` to avoid name collisions.
-                # extract features for both the mangled and un-mangled representations.
-                # e.g. `_fwrite` -> `fwrite`
-                # see: https://stackoverflow.com/a/2628384/87207
-                yield FunctionName(name[1:]), addr
-
-
-def extract_file_format() -> Iterator[Tuple[Feature, Address]]:
-    ef = currentProgram().getExecutableFormat()  # type: ignore [name-defined] # noqa: F821
-    if "PE" in ef:
-        yield Format(FORMAT_PE), NO_ADDRESS
-    elif "ELF" in ef:
-        yield Format(FORMAT_ELF), NO_ADDRESS
-    elif "Raw" in ef:
-        # no file type to return when processing a binary file, but we want to continue processing
-        return
-    else:
-        raise NotImplementedError(f"unexpected file format: {ef}")
-
-
-def extract_features() -> Iterator[Tuple[Feature, Address]]:
-    """extract file features"""
-    for file_handler in FILE_HANDLERS:
-        for feature, addr in file_handler():
-            yield feature, addr
-
-
-FILE_HANDLERS = (
-    extract_file_embedded_pe,
-    extract_file_export_names,
-    extract_file_import_names,
-    extract_file_section_names,
-    extract_file_strings,
-    extract_file_function_names,
-    extract_file_format,
-)
-
-
-def main():
-    """ """
-    import pprint
-
-    pprint.pprint(list(extract_features()))  # noqa: T203
-
-
-if __name__ == "__main__":
-    main()
--- a/capa/features/extractors/ghidra/function.py
+++ b/capa/features/extractors/ghidra/function.py
@@ -1,73 +0,0 @@
-# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
-# Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at: [package root]/LICENSE.txt
-# Unless required by applicable law or agreed to in writing, software distributed under the License
-#  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and limitations under the License.
-from typing import Tuple, Iterator
-
-import ghidra
-from ghidra.program.model.block import BasicBlockModel, SimpleBlockIterator
-
-import capa.features.extractors.ghidra.helpers
-from capa.features.common import Feature, Characteristic
-from capa.features.address import Address, AbsoluteVirtualAddress
-from capa.features.extractors import loops
-from capa.features.extractors.base_extractor import FunctionHandle
-
-
-def extract_function_calls_to(fh: FunctionHandle):
-    """extract callers to a function"""
-    f: ghidra.program.database.function.FunctionDB = fh.inner
-    for ref in f.getSymbol().getReferences():
-        if ref.getReferenceType().isCall():
-            yield Characteristic("calls to"), AbsoluteVirtualAddress(ref.getFromAddress().getOffset())
-
-
-def extract_function_loop(fh: FunctionHandle):
-    f: ghidra.program.database.function.FunctionDB = fh.inner
-
-    edges = []
-    for block in SimpleBlockIterator(BasicBlockModel(currentProgram()), f.getBody(), monitor()):  # type: ignore [name-defined] # noqa: F821
-        dests = block.getDestinations(monitor())  # type: ignore [name-defined] # noqa: F821
-        s_addrs = block.getStartAddresses()
-
-        while dests.hasNext():  # For loop throws Python TypeError
-            for addr in s_addrs:
-                edges.append((addr.getOffset(), dests.next().getDestinationAddress().getOffset()))
-
-    if loops.has_loop(edges):
-        yield Characteristic("loop"), AbsoluteVirtualAddress(f.getEntryPoint().getOffset())
-
-
-def extract_recursive_call(fh: FunctionHandle):
-    f: ghidra.program.database.function.FunctionDB = fh.inner
-
-    for func in f.getCalledFunctions(monitor()):  # type: ignore [name-defined] # noqa: F821
-        if func.getEntryPoint().getOffset() == f.getEntryPoint().getOffset():
-            yield Characteristic("recursive call"), AbsoluteVirtualAddress(f.getEntryPoint().getOffset())
-
-
-def extract_features(fh: FunctionHandle) -> Iterator[Tuple[Feature, Address]]:
-    for func_handler in FUNCTION_HANDLERS:
-        for feature, addr in func_handler(fh):
-            yield feature, addr
-
-
-FUNCTION_HANDLERS = (extract_function_calls_to, extract_function_loop, extract_recursive_call)
-
-
-def main():
-    """ """
-    features = []
-    for fhandle in capa.features.extractors.ghidra.helpers.get_function_symbols():
-        features.extend(list(extract_features(fhandle)))
-
-    import pprint
-
-    pprint.pprint(features)  # noqa: T203
-
-
-if __name__ == "__main__":
-    main()
--- a/capa/features/extractors/ghidra/global_.py
+++ b/capa/features/extractors/ghidra/global_.py
@@ -1,67 +0,0 @@
-# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
-# Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at: [package root]/LICENSE.txt
-# Unless required by applicable law or agreed to in writing, software distributed under the License
-#  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and limitations under the License.
-import logging
-import contextlib
-from typing import Tuple, Iterator
-
-import capa.ghidra.helpers
-import capa.features.extractors.elf
-import capa.features.extractors.ghidra.helpers
-from capa.features.common import OS, ARCH_I386, ARCH_AMD64, OS_WINDOWS, Arch, Feature
-from capa.features.address import NO_ADDRESS, Address
-
-logger = logging.getLogger(__name__)
-
-
-def extract_os() -> Iterator[Tuple[Feature, Address]]:
-    format_name: str = currentProgram().getExecutableFormat()  # type: ignore [name-defined] # noqa: F821
-
-    if "PE" in format_name:
-        yield OS(OS_WINDOWS), NO_ADDRESS
-
-    elif "ELF" in format_name:
-        with contextlib.closing(capa.ghidra.helpers.GHIDRAIO()) as f:
-            os = capa.features.extractors.elf.detect_elf_os(f)
-
-        yield OS(os), NO_ADDRESS
-
-    else:
-        # we likely end up here:
-        #  1. handling shellcode, or
-        #  2. handling a new file format (e.g. macho)
-        #
-        # for (1) we can't do much - its shellcode and all bets are off.
-        # we could maybe accept a further CLI argument to specify the OS,
-        # but i think this would be rarely used.
-        # rules that rely on OS conditions will fail to match on shellcode.
-        #
-        # for (2), this logic will need to be updated as the format is implemented.
-        logger.debug("unsupported file format: %s, will not guess OS", format_name)
-        return
-
-
-def extract_arch() -> Iterator[Tuple[Feature, Address]]:
-    lang_id = currentProgram().getMetadata().get("Language ID")  # type: ignore [name-defined] # noqa: F821
-
-    if "x86" in lang_id and "64" in lang_id:
-        yield Arch(ARCH_AMD64), NO_ADDRESS
-
-    elif "x86" in lang_id and "32" in lang_id:
-        yield Arch(ARCH_I386), NO_ADDRESS
-
-    elif "x86" not in lang_id:
-        logger.debug("unsupported architecture: non-32-bit nor non-64-bit intel")
-        return
-
-    else:
-        # we likely end up here:
-        #  1. handling a new architecture (e.g. aarch64)
-        #
-        # for (1), this logic will need to be updated as the format is implemented.
-        logger.debug("unsupported architecture: %s", lang_id)
-        return
--- a/capa/features/extractors/ghidra/helpers.py
+++ b/capa/features/extractors/ghidra/helpers.py
@@ -1,277 +0,0 @@
-# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
-# Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at: [package root]/LICENSE.txt
-# Unless required by applicable law or agreed to in writing, software distributed under the License
-#  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and limitations under the License.
-from typing import Dict, List, Iterator
-
-import ghidra
-import java.lang
-from ghidra.program.model.lang import OperandType
-from ghidra.program.model.block import BasicBlockModel, SimpleBlockIterator
-from ghidra.program.model.symbol import SourceType, SymbolType
-from ghidra.program.model.address import AddressSpace
-
-import capa.features.extractors.helpers
-from capa.features.common import THUNK_CHAIN_DEPTH_DELTA
-from capa.features.address import AbsoluteVirtualAddress
-from capa.features.extractors.base_extractor import BBHandle, InsnHandle, FunctionHandle
-
-
-def ints_to_bytes(bytez: List[int]) -> bytes:
-    """convert Java signed ints to Python bytes
-
-    args:
-        bytez: list of Java signed ints
-    """
-    return bytes([b & 0xFF for b in bytez])
-
-
-def find_byte_sequence(addr: ghidra.program.model.address.Address, seq: bytes) -> Iterator[int]:
-    """yield all ea of a given byte sequence
-
-    args:
-        addr: start address
-        seq: bytes to search e.g. b"\x01\x03"
-    """
-    seqstr = "".join([f"\\x{b:02x}" for b in seq])
-    eas = findBytes(addr, seqstr, java.lang.Integer.MAX_VALUE, 1)  # type: ignore [name-defined] # noqa: F821
-
-    yield from eas
-
-
-def get_bytes(addr: ghidra.program.model.address.Address, length: int) -> bytes:
-    """yield length bytes at addr
-
-    args:
-        addr: Address to begin pull from
-        length: length of bytes to pull
-    """
-    try:
-        return ints_to_bytes(getBytes(addr, length))  # type: ignore [name-defined] # noqa: F821
-    except RuntimeError:
-        return b""
-
-
-def get_block_bytes(block: ghidra.program.model.mem.MemoryBlock) -> bytes:
-    """yield all bytes in a given block
-
-    args:
-        block: MemoryBlock to pull from
-    """
-    return get_bytes(block.getStart(), block.getSize())
-
-
-def get_function_symbols():
-    """yield all non-external function symbols"""
-    yield from currentProgram().getFunctionManager().getFunctionsNoStubs(True)  # type: ignore [name-defined] # noqa: F821
-
-
-def get_function_blocks(fh: FunctionHandle) -> Iterator[BBHandle]:
-    """yield BBHandle for each bb in a given function"""
-
-    func: ghidra.program.database.function.FunctionDB = fh.inner
-    for bb in SimpleBlockIterator(BasicBlockModel(currentProgram()), func.getBody(), monitor()):  # type: ignore [name-defined] # noqa: F821
-        yield BBHandle(address=AbsoluteVirtualAddress(bb.getMinAddress().getOffset()), inner=bb)
-
-
-def get_insn_in_range(bbh: BBHandle) -> Iterator[InsnHandle]:
-    """yield InshHandle for each insn in a given basicblock"""
-    for insn in currentProgram().getListing().getInstructions(bbh.inner, True):  # type: ignore [name-defined] # noqa: F821
-        yield InsnHandle(address=AbsoluteVirtualAddress(insn.getAddress().getOffset()), inner=insn)
-
-
-def get_file_imports() -> Dict[int, List[str]]:
-    """get all import names & addrs"""
-
-    import_dict: Dict[int, List[str]] = {}
-
-    for f in currentProgram().getFunctionManager().getExternalFunctions():  # type: ignore [name-defined] # noqa: F821
-        for r in f.getSymbol().getReferences():
-            if r.getReferenceType().isData():
-                addr = r.getFromAddress().getOffset()  # gets pointer to fake external addr
-
-        ex_loc = f.getExternalLocation().getAddress()  # map external locations as well (offset into module files)
-
-        fstr = f.toString().split("::")  # format: MODULE.dll::import / MODULE::Ordinal_* / <EXTERNAL>::import
-        if "Ordinal_" in fstr[1]:
-            fstr[1] = f"#{fstr[1].split('_')[1]}"
-
-        # <EXTERNAL> mostly shows up in ELF files, otherwise, strip '.dll' w/ [:-4]
-        fstr[0] = "*" if "<EXTERNAL>" in fstr[0] else fstr[0][:-4]
-
-        for name in capa.features.extractors.helpers.generate_symbols(fstr[0], fstr[1]):
-            import_dict.setdefault(addr, []).append(name)
-            if ex_loc:
-                import_dict.setdefault(ex_loc.getOffset(), []).append(name)
-
-    return import_dict
-
-
-def get_file_externs() -> Dict[int, List[str]]:
-    """
-    Gets function names & addresses of statically-linked library functions
-
-    Ghidra's external namespace is mostly reserved for dynamically-linked
-    imports. Statically-linked functions are part of the global namespace.
-    Filtering on the type, source, and namespace of the symbols yield more
-    statically-linked library functions.
-
-    Example: (PMA Lab 16-01.exe_) 7faafc7e4a5c736ebfee6abbbc812d80:0x407490
-    - __aulldiv
-    - Note: See Symbol Table labels
-    """
-
-    extern_dict: Dict[int, List[str]] = {}
-
-    for sym in currentProgram().getSymbolTable().getAllSymbols(True):  # type: ignore [name-defined] # noqa: F821
-        # .isExternal() misses more than this config for the function symbols
-        if sym.getSymbolType() == SymbolType.FUNCTION and sym.getSource() == SourceType.ANALYSIS and sym.isGlobal():
-            name = sym.getName()  # starts to resolve names based on Ghidra's FidDB
-            if name.startswith("FID_conflict:"):  # format: FID_conflict:<function-name>
-                name = name[13:]
-            extern_dict.setdefault(sym.getAddress().getOffset(), []).append(name)
-            if name.startswith("_"):
-                # some linkers may prefix linked routines with a `_` to avoid name collisions.
-                # extract features for both the mangled and un-mangled representations.
-                # e.g. `_fwrite` -> `fwrite`
-                # see: https://stackoverflow.com/a/2628384/87207
-                extern_dict.setdefault(sym.getAddress().getOffset(), []).append(name[1:])
-
-    return extern_dict
-
-
-def map_fake_import_addrs() -> Dict[int, List[int]]:
-    """
-    Map ghidra's fake import entrypoints to their
-    real addresses
-
-    Helps as many Ghidra Scripting API calls end up returning
-    these external (fake) addresses.
-
-    Undocumented but intended Ghidra behavior:
-     - Import entryPoint fields are stored in the 'EXTERNAL:' AddressSpace.
-       'getEntryPoint()' returns the entryPoint field, which is an offset
-       from the beginning of the assigned AddressSpace. In the case of externals,
-       they start from 1 and increment.
-    https://github.com/NationalSecurityAgency/ghidra/blob/26d4bd9104809747c21f2528cab8aba9aef9acd5/Ghidra/Features/Base/src/test.slow/java/ghidra/program/database/function/ExternalFunctionDBTest.java#L90
-
-    Example: (mimikatz.exe_) 5f66b82558ca92e54e77f216ef4c066c:0x473090
-    - 0x473090 -> PTR_CreateServiceW_00473090
-    - 'EXTERNAL:00000025' -> External Address (ghidra.program.model.address.SpecialAddress)
-    """
-    fake_dict: Dict[int, List[int]] = {}
-
-    for f in currentProgram().getFunctionManager().getExternalFunctions():  # type: ignore [name-defined] # noqa: F821
-        for r in f.getSymbol().getReferences():
-            if r.getReferenceType().isData():
-                fake_dict.setdefault(f.getEntryPoint().getOffset(), []).append(r.getFromAddress().getOffset())
-
-    return fake_dict
-
-
-def check_addr_for_api(
-    addr: ghidra.program.model.address.Address,
-    fakes: Dict[int, List[int]],
-    imports: Dict[int, List[str]],
-    externs: Dict[int, List[str]],
-) -> bool:
-    offset = addr.getOffset()
-
-    fake = fakes.get(offset)
-    if fake:
-        return True
-
-    imp = imports.get(offset)
-    if imp:
-        return True
-
-    extern = externs.get(offset)
-    if extern:
-        return True
-
-    return False
-
-
-def is_call_or_jmp(insn: ghidra.program.database.code.InstructionDB) -> bool:
-    return any(mnem in insn.getMnemonicString() for mnem in ["CALL", "J"])  # JMP, JNE, JNZ, etc
-
-
-def is_sp_modified(insn: ghidra.program.database.code.InstructionDB) -> bool:
-    for i in range(insn.getNumOperands()):
-        if insn.getOperandType(i) == OperandType.REGISTER:
-            return "SP" in insn.getRegister(i).getName() and insn.getOperandRefType(i).isWrite()
-    return False
-
-
-def is_stack_referenced(insn: ghidra.program.database.code.InstructionDB) -> bool:
-    """generic catch-all for stack references"""
-    for i in range(insn.getNumOperands()):
-        if insn.getOperandType(i) == OperandType.REGISTER:
-            if "BP" in insn.getRegister(i).getName():
-                return True
-            else:
-                continue
-
-    return any(ref.isStackReference() for ref in insn.getReferencesFrom())
-
-
-def is_zxor(insn: ghidra.program.database.code.InstructionDB) -> bool:
-    # assume XOR insn
-    # XOR's against the same operand zero out
-    ops = []
-    operands = []
-    for i in range(insn.getNumOperands()):
-        ops.append(insn.getOpObjects(i))
-
-    # Operands stored in a 2D array
-    for j in range(len(ops)):
-        for k in range(len(ops[j])):
-            operands.append(ops[j][k])
-
-    return all(n == operands[0] for n in operands)
-
-
-def handle_thunk(addr: ghidra.program.model.address.Address):
-    """Follow thunk chains down to a reasonable depth"""
-    ref = addr
-    for _ in range(THUNK_CHAIN_DEPTH_DELTA):
-        thunk_jmp = getInstructionAt(ref)  # type: ignore [name-defined] # noqa: F821
-        if thunk_jmp and is_call_or_jmp(thunk_jmp):
-            if OperandType.isAddress(thunk_jmp.getOperandType(0)):
-                ref = thunk_jmp.getAddress(0)
-        else:
-            thunk_dat = getDataContaining(ref)  # type: ignore [name-defined] # noqa: F821
-            if thunk_dat and thunk_dat.isDefined() and thunk_dat.isPointer():
-                ref = thunk_dat.getValue()
-                break  # end of thunk chain reached
-    return ref
-
-
-def dereference_ptr(insn: ghidra.program.database.code.InstructionDB):
-    addr_code = OperandType.ADDRESS | OperandType.CODE
-    to_deref = insn.getAddress(0)
-    dat = getDataContaining(to_deref)  # type: ignore [name-defined] # noqa: F821
-
-    if insn.getOperandType(0) == addr_code:
-        thfunc = getFunctionContaining(to_deref)  # type: ignore [name-defined] # noqa: F821
-        if thfunc and thfunc.isThunk():
-            return handle_thunk(to_deref)
-        else:
-            # if it doesn't poin to a thunk, it's usually a jmp to a label
-            return to_deref
-    if not dat:
-        return to_deref
-    if dat.isDefined() and dat.isPointer():
-        addr = dat.getValue()
-        # now we need to check the addr space to see if it is truly resolvable
-        # ghidra sometimes likes to hand us direct RAM addrs, which typically point
-        # to api calls that we can't actually resolve as such
-        if addr.getAddressSpace().getType() == AddressSpace.TYPE_RAM:
-            return to_deref
-        else:
-            return addr
-    else:
-        return to_deref
--- a/capa/features/extractors/ghidra/insn.py
+++ b/capa/features/extractors/ghidra/insn.py
@@ -1,521 +0,0 @@
-# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
-# Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at: [package root]/LICENSE.txt
-# Unless required by applicable law or agreed to in writing, software distributed under the License
-#  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and limitations under the License.
-from typing import Any, Dict, Tuple, Iterator
-
-import ghidra
-from ghidra.program.model.lang import OperandType
-from ghidra.program.model.block import SimpleBlockModel
-
-import capa.features.extractors.helpers
-import capa.features.extractors.ghidra.helpers
-from capa.features.insn import API, MAX_STRUCTURE_SIZE, Number, Offset, Mnemonic, OperandNumber, OperandOffset
-from capa.features.common import MAX_BYTES_FEATURE_SIZE, Bytes, String, Feature, Characteristic
-from capa.features.address import Address, AbsoluteVirtualAddress
-from capa.features.extractors.base_extractor import BBHandle, InsnHandle, FunctionHandle
-
-# security cookie checks may perform non-zeroing XORs, these are expected within a certain
-# byte range within the first and returning basic blocks, this helps to reduce FP features
-SECURITY_COOKIE_BYTES_DELTA = 0x40
-
-
-def get_imports(ctx: Dict[str, Any]) -> Dict[int, Any]:
-    """Populate the import cache for this context"""
-    if "imports_cache" not in ctx:
-        ctx["imports_cache"] = capa.features.extractors.ghidra.helpers.get_file_imports()
-    return ctx["imports_cache"]
-
-
-def get_externs(ctx: Dict[str, Any]) -> Dict[int, Any]:
-    """Populate the externs cache for this context"""
-    if "externs_cache" not in ctx:
-        ctx["externs_cache"] = capa.features.extractors.ghidra.helpers.get_file_externs()
-    return ctx["externs_cache"]
-
-
-def get_fakes(ctx: Dict[str, Any]) -> Dict[int, Any]:
-    """Populate the fake import addrs cache for this context"""
-    if "fakes_cache" not in ctx:
-        ctx["fakes_cache"] = capa.features.extractors.ghidra.helpers.map_fake_import_addrs()
-    return ctx["fakes_cache"]
-
-
-def check_for_api_call(
-    insn, externs: Dict[int, Any], fakes: Dict[int, Any], imports: Dict[int, Any], imp_or_ex: bool
-) -> Iterator[Any]:
-    """check instruction for API call
-
-    params:
-        externs - external library functions cache
-        fakes - mapped fake import addresses cache
-        imports - imported functions cache
-        imp_or_ex - flag to check imports or externs
-
-    yields:
-        matched api calls
-    """
-    info = ()
-    funcs = imports if imp_or_ex else externs
-
-    # assume only CALLs or JMPs are passed
-    ref_type = insn.getOperandType(0)
-    addr_data = OperandType.ADDRESS | OperandType.DATA  # needs dereferencing
-    addr_code = OperandType.ADDRESS | OperandType.CODE  # needs dereferencing
-
-    if OperandType.isRegister(ref_type):
-        if OperandType.isAddress(ref_type):
-            # If it's an address in a register, check the mapped fake addrs
-            # since they're dereferenced to their fake addrs
-            op_ref = insn.getAddress(0).getOffset()
-            ref = fakes.get(op_ref)  # obtain the real addr
-            if not ref:
-                return
-        else:
-            return
-    elif ref_type in (addr_data, addr_code) or (OperandType.isIndirect(ref_type) and OperandType.isAddress(ref_type)):
-        # we must dereference and check if the addr is a pointer to an api function
-        addr_ref = capa.features.extractors.ghidra.helpers.dereference_ptr(insn)
-        if not capa.features.extractors.ghidra.helpers.check_addr_for_api(addr_ref, fakes, imports, externs):
-            return
-        ref = addr_ref.getOffset()
-    elif ref_type == OperandType.DYNAMIC | OperandType.ADDRESS or ref_type == OperandType.DYNAMIC:
-        return  # cannot resolve dynamics statically
-    else:
-        # pure address does not need to get dereferenced/ handled
-        addr_ref = insn.getAddress(0)
-        if not addr_ref:
-            # If it returned null, it was an indirect
-            # that had no address reference.
-            # This check is faster than checking for (indirect and not address)
-            return
-        if not capa.features.extractors.ghidra.helpers.check_addr_for_api(addr_ref, fakes, imports, externs):
-            return
-        ref = addr_ref.getOffset()
-
-    if isinstance(ref, list):  # ref from REG | ADDR
-        for r in ref:
-            info = funcs.get(r)  # type: ignore
-            if info:
-                yield info
-    else:
-        info = funcs.get(ref)  # type: ignore
-        if info:
-            yield info
-
-
-def extract_insn_api_features(fh: FunctionHandle, bb: BBHandle, ih: InsnHandle) -> Iterator[Tuple[Feature, Address]]:
-    insn: ghidra.program.database.code.InstructionDB = ih.inner
-
-    if not capa.features.extractors.ghidra.helpers.is_call_or_jmp(insn):
-        return
-
-    externs = get_externs(fh.ctx)
-    fakes = get_fakes(fh.ctx)
-    imports = get_imports(fh.ctx)
-
-    # check calls to imported functions
-    for api in check_for_api_call(insn, externs, fakes, imports, True):
-        for imp in api:
-            yield API(imp), ih.address
-
-    # check calls to extern functions
-    for api in check_for_api_call(insn, externs, fakes, imports, False):
-        for ext in api:
-            yield API(ext), ih.address
-
-
-def extract_insn_number_features(fh: FunctionHandle, bb: BBHandle, ih: InsnHandle) -> Iterator[Tuple[Feature, Address]]:
-    """
-    parse instruction number features
-    example:
-        push    3136B0h         ; dwControlCode
-    """
-    insn: ghidra.program.database.code.InstructionDB = ih.inner
-
-    if insn.getMnemonicString().startswith("RET"):
-        # skip things like:
-        #   .text:0042250E retn 8
-        return
-
-    if capa.features.extractors.ghidra.helpers.is_sp_modified(insn):
-        # skip things like:
-        #   .text:00401145 add esp, 0Ch
-        return
-
-    for i in range(insn.getNumOperands()):
-        # Exceptions for LEA insn:
-        # invalid operand encoding, considered numbers instead of offsets
-        # see: mimikatz.exe_:0x4018C0
-        if insn.getOperandType(i) == OperandType.DYNAMIC and insn.getMnemonicString().startswith("LEA"):
-            # Additional check, avoid yielding "wide" values (ex. mimikatz.exe:0x471EE6 LEA EBX, [ECX + EAX*0x4])
-            op_objs = insn.getOpObjects(i)
-            if len(op_objs) == 3:  # ECX, EAX, 0x4
-                continue
-
-            if isinstance(op_objs[-1], ghidra.program.model.scalar.Scalar):
-                const = op_objs[-1].getUnsignedValue()
-                addr = ih.address
-
-                yield Number(const), addr
-                yield OperandNumber(i, const), addr
-        elif not OperandType.isScalar(insn.getOperandType(i)):
-            # skip things like:
-            #   references, void types
-            continue
-        else:
-            const = insn.getScalar(i).getUnsignedValue()
-            addr = ih.address
-
-            yield Number(const), addr
-            yield OperandNumber(i, const), addr
-
-            if insn.getMnemonicString().startswith("ADD") and 0 < const < MAX_STRUCTURE_SIZE:
-                # for pattern like:
-                #
-                #     add eax, 0x10
-                #
-                # assume 0x10 is also an offset (imagine eax is a pointer).
-                yield Offset(const), addr
-                yield OperandOffset(i, const), addr
-
-
-def extract_insn_offset_features(fh: FunctionHandle, bb: BBHandle, ih: InsnHandle) -> Iterator[Tuple[Feature, Address]]:
-    """
-    parse instruction structure offset features
-
-    example:
-        .text:0040112F cmp [esi+4], ebx
-    """
-    insn: ghidra.program.database.code.InstructionDB = ih.inner
-
-    if insn.getMnemonicString().startswith("LEA"):
-        return
-
-    # ignore any stack references
-    if not capa.features.extractors.ghidra.helpers.is_stack_referenced(insn):
-        # Ghidra stores operands in 2D arrays if they contain offsets
-        for i in range(insn.getNumOperands()):
-            if insn.getOperandType(i) == OperandType.DYNAMIC:  # e.g. [esi + 4]
-                # manual extraction, since the default api calls only work on the 1st dimension of the array
-                op_objs = insn.getOpObjects(i)
-                if isinstance(op_objs[-1], ghidra.program.model.scalar.Scalar):
-                    op_off = op_objs[-1].getValue()
-                    yield Offset(op_off), ih.address
-                    yield OperandOffset(i, op_off), ih.address
-                else:
-                    yield Offset(0), ih.address
-                    yield OperandOffset(i, 0), ih.address
-
-
-def extract_insn_bytes_features(fh: FunctionHandle, bb: BBHandle, ih: InsnHandle) -> Iterator[Tuple[Feature, Address]]:
-    """
-    parse referenced byte sequences
-    example:
-        push    offset iid_004118d4_IShellLinkA ; riid
-    """
-    insn: ghidra.program.database.code.InstructionDB = ih.inner
-
-    if capa.features.extractors.ghidra.helpers.is_call_or_jmp(insn):
-        return
-
-    ref = insn.getAddress()  # init to insn addr
-    for i in range(insn.getNumOperands()):
-        if OperandType.isAddress(insn.getOperandType(i)):
-            ref = insn.getAddress(i)  # pulls pointer if there is one
-
-    if ref != insn.getAddress():  # bail out if there's no pointer
-        ghidra_dat = getDataAt(ref)  # type: ignore [name-defined] # noqa: F821
-        if (
-            ghidra_dat and not ghidra_dat.hasStringValue() and not ghidra_dat.isPointer()
-        ):  # avoid if the data itself is a pointer
-            extracted_bytes = capa.features.extractors.ghidra.helpers.get_bytes(ref, MAX_BYTES_FEATURE_SIZE)
-            if extracted_bytes and not capa.features.extractors.helpers.all_zeros(extracted_bytes):
-                # don't extract byte features for obvious strings
-                yield Bytes(extracted_bytes), ih.address
-
-
-def extract_insn_string_features(fh: FunctionHandle, bb: BBHandle, ih: InsnHandle) -> Iterator[Tuple[Feature, Address]]:
-    """
-    parse instruction string features
-
-    example:
-        push offset aAcr     ; "ACR  > "
-    """
-    insn: ghidra.program.database.code.InstructionDB = ih.inner
-    dyn_addr = OperandType.DYNAMIC | OperandType.ADDRESS
-
-    ref = insn.getAddress()
-    for i in range(insn.getNumOperands()):
-        if OperandType.isScalarAsAddress(insn.getOperandType(i)):
-            ref = insn.getAddress(i)
-        # strings are also referenced dynamically via pointers & arrays, so we need to deref them
-        if insn.getOperandType(i) == dyn_addr:
-            ref = insn.getAddress(i)
-            dat = getDataAt(ref)  # type: ignore [name-defined] # noqa: F821
-            if dat and dat.isPointer():
-                ref = dat.getValue()
-
-    if ref != insn.getAddress():
-        ghidra_dat = getDataAt(ref)  # type: ignore [name-defined] # noqa: F821
-        if ghidra_dat and ghidra_dat.hasStringValue():
-            yield String(ghidra_dat.getValue()), ih.address
-
-
-def extract_insn_mnemonic_features(
-    fh: FunctionHandle, bb: BBHandle, ih: InsnHandle
-) -> Iterator[Tuple[Feature, Address]]:
-    """parse instruction mnemonic features"""
-    insn: ghidra.program.database.code.InstructionDB = ih.inner
-
-    yield Mnemonic(insn.getMnemonicString().lower()), ih.address
-
-
-def extract_insn_obfs_call_plus_5_characteristic_features(
-    fh: FunctionHandle, bb: BBHandle, ih: InsnHandle
-) -> Iterator[Tuple[Feature, Address]]:
-    """
-    parse call $+5 instruction from the given instruction.
-    """
-    insn: ghidra.program.database.code.InstructionDB = ih.inner
-
-    if not capa.features.extractors.ghidra.helpers.is_call_or_jmp(insn):
-        return
-
-    code_ref = OperandType.ADDRESS | OperandType.CODE
-    ref = insn.getAddress()
-    for i in range(insn.getNumOperands()):
-        if insn.getOperandType(i) == code_ref:
-            ref = insn.getAddress(i)
-
-    if insn.getAddress().add(5) == ref:
-        yield Characteristic("call $+5"), ih.address
-
-
-def extract_insn_segment_access_features(
-    fh: FunctionHandle, bb: BBHandle, ih: InsnHandle
-) -> Iterator[Tuple[Feature, Address]]:
-    """parse instruction fs or gs access"""
-    insn: ghidra.program.database.code.InstructionDB = ih.inner
-
-    insn_str = insn.toString()
-
-    if "FS:" in insn_str:
-        yield Characteristic("fs access"), ih.address
-
-    if "GS:" in insn_str:
-        yield Characteristic("gs access"), ih.address
-
-
-def extract_insn_peb_access_characteristic_features(
-    fh: FunctionHandle, bb: BBHandle, ih: InsnHandle
-) -> Iterator[Tuple[Feature, Address]]:
-    """parse instruction peb access
-
-    fs:[0x30] on x86, gs:[0x60] on x64
-
-    """
-    insn: ghidra.program.database.code.InstructionDB = ih.inner
-
-    insn_str = insn.toString()
-    if insn_str.startswith(("PUSH", "MOV")):
-        if "FS:[0x30]" in insn_str or "GS:[0x60]" in insn_str:
-            yield Characteristic("peb access"), ih.address
-
-
-def extract_insn_cross_section_cflow(
-    fh: FunctionHandle, bb: BBHandle, ih: InsnHandle
-) -> Iterator[Tuple[Feature, Address]]:
-    """inspect the instruction for a CALL or JMP that crosses section boundaries"""
-    insn: ghidra.program.database.code.InstructionDB = ih.inner
-
-    if not capa.features.extractors.ghidra.helpers.is_call_or_jmp(insn):
-        return
-
-    externs = get_externs(fh.ctx)
-    fakes = get_fakes(fh.ctx)
-    imports = get_imports(fh.ctx)
-
-    # OperandType to dereference
-    addr_data = OperandType.ADDRESS | OperandType.DATA
-    addr_code = OperandType.ADDRESS | OperandType.CODE
-
-    ref_type = insn.getOperandType(0)
-
-    # both OperandType flags must be present
-    # bail on REGISTER alone
-    if OperandType.isRegister(ref_type):
-        if OperandType.isAddress(ref_type):
-            ref = insn.getAddress(0)  # Ghidra dereferences REG | ADDR
-            if capa.features.extractors.ghidra.helpers.check_addr_for_api(ref, fakes, imports, externs):
-                return
-        else:
-            return
-    elif ref_type in (addr_data, addr_code) or (OperandType.isIndirect(ref_type) and OperandType.isAddress(ref_type)):
-        # we must dereference and check if the addr is a pointer to an api function
-        ref = capa.features.extractors.ghidra.helpers.dereference_ptr(insn)
-        if capa.features.extractors.ghidra.helpers.check_addr_for_api(ref, fakes, imports, externs):
-            return
-    elif ref_type == OperandType.DYNAMIC | OperandType.ADDRESS or ref_type == OperandType.DYNAMIC:
-        return  # cannot resolve dynamics statically
-    else:
-        # pure address does not need to get dereferenced/ handled
-        ref = insn.getAddress(0)
-        if not ref:
-            # If it returned null, it was an indirect
-            # that had no address reference.
-            # This check is faster than checking for (indirect and not address)
-            return
-        if capa.features.extractors.ghidra.helpers.check_addr_for_api(ref, fakes, imports, externs):
-            return
-
-    this_mem_block = getMemoryBlock(insn.getAddress())  # type: ignore [name-defined] # noqa: F821
-    ref_block = getMemoryBlock(ref)  # type: ignore [name-defined] # noqa: F821
-    if ref_block != this_mem_block:
-        yield Characteristic("cross section flow"), ih.address
-
-
-def extract_function_calls_from(
-    fh: FunctionHandle,
-    bb: BBHandle,
-    ih: InsnHandle,
-) -> Iterator[Tuple[Feature, Address]]:
-    """extract functions calls from features
-
-    most relevant at the function scope, however, its most efficient to extract at the instruction scope
-    """
-    insn: ghidra.program.database.code.InstructionDB = ih.inner
-
-    if insn.getMnemonicString().startswith("CALL"):
-        # This method of "dereferencing" addresses/ pointers
-        # is not as robust as methods in other functions,
-        # but works just fine for this one
-        reference = 0
-        for ref in insn.getReferencesFrom():
-            addr = ref.getToAddress()
-
-            # avoid returning fake addrs
-            if not addr.isExternalAddress():
-                reference = addr.getOffset()
-
-            # if a reference is < 0, then ghidra pulled an offset from a DYNAMIC | ADDR (usually a stackvar)
-            # these cannot be resolved to actual addrs
-            if reference > 0:
-                yield Characteristic("calls from"), AbsoluteVirtualAddress(reference)
-
-
-def extract_function_indirect_call_characteristic_features(
-    fh: FunctionHandle,
-    bb: BBHandle,
-    ih: InsnHandle,
-) -> Iterator[Tuple[Feature, Address]]:
-    """extract indirect function calls (e.g., call eax or call dword ptr [edx+4])
-    does not include calls like => call ds:dword_ABD4974
-
-    most relevant at the function or basic block scope;
-    however, its most efficient to extract at the instruction scope
-    """
-    insn: ghidra.program.database.code.InstructionDB = ih.inner
-
-    if insn.getMnemonicString().startswith("CALL"):
-        if OperandType.isRegister(insn.getOperandType(0)):
-            yield Characteristic("indirect call"), ih.address
-        if OperandType.isIndirect(insn.getOperandType(0)):
-            yield Characteristic("indirect call"), ih.address
-
-
-def check_nzxor_security_cookie_delta(
-    fh: ghidra.program.database.function.FunctionDB, insn: ghidra.program.database.code.InstructionDB
-):
-    """Get the function containing the insn
-    Get the last block of the function that contains the insn
-
-    Check the bb containing the insn
-    Check the last bb of the function containing the insn
-    """
-
-    model = SimpleBlockModel(currentProgram())  # type: ignore [name-defined] # noqa: F821
-    insn_addr = insn.getAddress()
-    func_asv = fh.getBody()
-    first_addr = func_asv.getMinAddress()
-    last_addr = func_asv.getMaxAddress()
-
-    if model.getFirstCodeBlockContaining(
-        first_addr, monitor()  # type: ignore [name-defined] # noqa: F821
-    ) == model.getFirstCodeBlockContaining(
-        last_addr, monitor()  # type: ignore [name-defined] # noqa: F821
-    ):
-        if insn_addr < first_addr.add(SECURITY_COOKIE_BYTES_DELTA):
-            return True
-        else:
-            return insn_addr > last_addr.add(SECURITY_COOKIE_BYTES_DELTA * -1)
-    else:
-        return False
-
-
-def extract_insn_nzxor_characteristic_features(
-    fh: FunctionHandle,
-    bb: BBHandle,
-    ih: InsnHandle,
-) -> Iterator[Tuple[Feature, Address]]:
-    f: ghidra.program.database.function.FunctionDB = fh.inner
-    insn: ghidra.program.database.code.InstructionDB = ih.inner
-
-    if "XOR" not in insn.getMnemonicString():
-        return
-    if capa.features.extractors.ghidra.helpers.is_stack_referenced(insn):
-        return
-    if capa.features.extractors.ghidra.helpers.is_zxor(insn):
-        return
-    if check_nzxor_security_cookie_delta(f, insn):
-        return
-    yield Characteristic("nzxor"), ih.address
-
-
-def extract_features(
-    fh: FunctionHandle,
-    bb: BBHandle,
-    insn: InsnHandle,
-) -> Iterator[Tuple[Feature, Address]]:
-    for insn_handler in INSTRUCTION_HANDLERS:
-        for feature, addr in insn_handler(fh, bb, insn):
-            yield feature, addr
-
-
-INSTRUCTION_HANDLERS = (
-    extract_insn_api_features,
-    extract_insn_number_features,
-    extract_insn_bytes_features,
-    extract_insn_string_features,
-    extract_insn_offset_features,
-    extract_insn_nzxor_characteristic_features,
-    extract_insn_mnemonic_features,
-    extract_insn_obfs_call_plus_5_characteristic_features,
-    extract_insn_peb_access_characteristic_features,
-    extract_insn_cross_section_cflow,
-    extract_insn_segment_access_features,
-    extract_function_calls_from,
-    extract_function_indirect_call_characteristic_features,
-)
-
-
-def main():
-    """ """
-    features = []
-    from capa.features.extractors.ghidra.extractor import GhidraFeatureExtractor
-
-    for fh in GhidraFeatureExtractor().get_functions():
-        for bb in capa.features.extractors.ghidra.helpers.get_function_blocks(fh):
-            for insn in capa.features.extractors.ghidra.helpers.get_insn_in_range(bb):
-                features.extend(list(extract_features(fh, bb, insn)))
-
-    import pprint
-
-    pprint.pprint(features)  # noqa: T203
-
-
-if __name__ == "__main__":
-    main()
--- a/capa/features/extractors/helpers.py
+++ b/capa/features/extractors/helpers.py
@@ -41,50 +41,38 @@ def is_ordinal(symbol: str) -> bool:
    return False


-def generate_symbols(dll: str, symbol: str, include_dll=False) -> Iterator[str]:
+def generate_symbols(dll: str, symbol: str) -> Iterator[str]:
    """
    for a given dll and symbol name, generate variants.
    we over-generate features to make matching easier.
    these include:
-      - CreateFileA
-      - CreateFile
-      - ws2_32.#1
-
-    note that since capa v7 only `import` features and APIs called via ordinal include DLL names:
      - kernel32.CreateFileA
      - kernel32.CreateFile
-      - ws2_32.#1
-
-    for `api` features dll names are good for documentation but not used during matching
+      - CreateFileA
+      - CreateFile
    """
    # normalize dll name
    dll = dll.lower()

-    # trim extensions observed in dynamic traces
-    dll = dll[0:-4] if dll.endswith(".dll") else dll
-    dll = dll[0:-4] if dll.endswith(".drv") else dll
-
-    if include_dll or is_ordinal(symbol):
-        # ws2_32.#1
-        # kernel32.CreateFileA
-        yield f"{dll}.{symbol}"
+    # kernel32.CreateFileA
+    yield f"{dll}.{symbol}"

    if not is_ordinal(symbol):
        # CreateFileA
        yield symbol

-        if is_aw_function(symbol):
-            if include_dll:
-                # kernel32.CreateFile
-                yield f"{dll}.{symbol[:-1]}"
+    if is_aw_function(symbol):
+        # kernel32.CreateFile
+        yield f"{dll}.{symbol[:-1]}"

+        if not is_ordinal(symbol):
            # CreateFile
            yield symbol[:-1]


 def reformat_forwarded_export_name(forwarded_name: str) -> str:
    """
-    a forwarded export has a DLL name/path and symbol name.
+    a forwarded export has a DLL name/path an symbol name.
    we want the former to be lowercase, and the latter to be verbatim.
    """

--- a/capa/features/extractors/ida/extractor.py
+++ b/capa/features/extractors/ida/extractor.py
@@ -8,7 +8,6 @@
 from typing import List, Tuple, Iterator

 import idaapi
-import ida_nalt

 import capa.ida.helpers
 import capa.features.extractors.elf
@@ -19,22 +18,12 @@ import capa.features.extractors.ida.function
 import capa.features.extractors.ida.basicblock
 from capa.features.common import Feature
 from capa.features.address import Address, AbsoluteVirtualAddress
-from capa.features.extractors.base_extractor import (
-    BBHandle,
-    InsnHandle,
-    SampleHashes,
-    FunctionHandle,
-    StaticFeatureExtractor,
-)
+from capa.features.extractors.base_extractor import BBHandle, InsnHandle, FunctionHandle, FeatureExtractor


-class IdaFeatureExtractor(StaticFeatureExtractor):
+class IdaFeatureExtractor(FeatureExtractor):
    def __init__(self):
-        super().__init__(
-            hashes=SampleHashes(
-                md5=ida_nalt.retrieve_input_file_md5(), sha1="(unknown)", sha256=ida_nalt.retrieve_input_file_sha256()
-            )
-        )
+        super().__init__()
        self.global_features: List[Tuple[Feature, Address]] = []
        self.global_features.extend(capa.features.extractors.ida.file.extract_file_format())
        self.global_features.extend(capa.features.extractors.ida.global_.extract_os())
--- a/capa/features/extractors/ida/file.py
+++ b/capa/features/extractors/ida/file.py
@@ -110,7 +110,7 @@ def extract_file_import_names() -> Iterator[Tuple[Feature, Address]]:
        if info[1] and info[2]:
            # e.g. in mimikatz: ('cabinet', 'FCIAddFile', 11L)
            # extract by name here and by ordinal below
-            for name in capa.features.extractors.helpers.generate_symbols(info[0], info[1], include_dll=True):
+            for name in capa.features.extractors.helpers.generate_symbols(info[0], info[1]):
                yield Import(name), addr
            dll = info[0]
            symbol = f"#{info[2]}"
@@ -123,7 +123,7 @@ def extract_file_import_names() -> Iterator[Tuple[Feature, Address]]:
        else:
            continue

-        for name in capa.features.extractors.helpers.generate_symbols(dll, symbol, include_dll=True):
+        for name in capa.features.extractors.helpers.generate_symbols(dll, symbol):
            yield Import(name), addr

    for ea, info in capa.features.extractors.ida.helpers.get_file_externs().items():
--- a/capa/features/extractors/null.py
+++ b/capa/features/extractors/null.py
@@ -5,24 +5,12 @@
 # Unless required by applicable law or agreed to in writing, software distributed under the License
 #  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and limitations under the License.
-from typing import Dict, List, Tuple, Union
+from typing import Dict, List, Tuple
 from dataclasses import dataclass

-from typing_extensions import TypeAlias
-
 from capa.features.common import Feature
-from capa.features.address import NO_ADDRESS, Address, ThreadAddress, ProcessAddress, DynamicCallAddress
-from capa.features.extractors.base_extractor import (
-    BBHandle,
-    CallHandle,
-    InsnHandle,
-    SampleHashes,
-    ThreadHandle,
-    ProcessHandle,
-    FunctionHandle,
-    StaticFeatureExtractor,
-    DynamicFeatureExtractor,
-)
+from capa.features.address import NO_ADDRESS, Address
+from capa.features.extractors.base_extractor import BBHandle, InsnHandle, FunctionHandle, FeatureExtractor


@dataclass
@@ -43,7 +31,7 @@ class FunctionFeatures:


@dataclass
-class NullStaticFeatureExtractor(StaticFeatureExtractor):
+class NullFeatureExtractor(FeatureExtractor):
    """
    An extractor that extracts some user-provided features.

@@ -51,7 +39,6 @@ class NullStaticFeatureExtractor(StaticFeatureExtractor):
    """

    base_address: Address
-    sample_hashes: SampleHashes
    global_features: List[Feature]
    file_features: List[Tuple[Address, Feature]]
    functions: Dict[Address, FunctionFeatures]
@@ -59,9 +46,6 @@ class NullStaticFeatureExtractor(StaticFeatureExtractor):
    def get_base_address(self):
        return self.base_address

-    def get_sample_hashes(self) -> SampleHashes:
-        return self.sample_hashes
-
    def extract_global_features(self):
        for feature in self.global_features:
            yield feature, NO_ADDRESS
@@ -93,78 +77,3 @@ class NullStaticFeatureExtractor(StaticFeatureExtractor):
    def extract_insn_features(self, f, bb, insn):
        for address, feature in self.functions[f.address].basic_blocks[bb.address].instructions[insn.address].features:
            yield feature, address
-
-
-@dataclass
-class CallFeatures:
-    name: str
-    features: List[Tuple[Address, Feature]]
-
-
-@dataclass
-class ThreadFeatures:
-    features: List[Tuple[Address, Feature]]
-    calls: Dict[Address, CallFeatures]
-
-
-@dataclass
-class ProcessFeatures:
-    features: List[Tuple[Address, Feature]]
-    threads: Dict[Address, ThreadFeatures]
-    name: str
-
-
-@dataclass
-class NullDynamicFeatureExtractor(DynamicFeatureExtractor):
-    base_address: Address
-    sample_hashes: SampleHashes
-    global_features: List[Feature]
-    file_features: List[Tuple[Address, Feature]]
-    processes: Dict[Address, ProcessFeatures]
-
-    def extract_global_features(self):
-        for feature in self.global_features:
-            yield feature, NO_ADDRESS
-
-    def get_sample_hashes(self) -> SampleHashes:
-        return self.sample_hashes
-
-    def extract_file_features(self):
-        for address, feature in self.file_features:
-            yield feature, address
-
-    def get_processes(self):
-        for address in sorted(self.processes.keys()):
-            assert isinstance(address, ProcessAddress)
-            yield ProcessHandle(address=address, inner={})
-
-    def extract_process_features(self, ph):
-        for addr, feature in self.processes[ph.address].features:
-            yield feature, addr
-
-    def get_process_name(self, ph) -> str:
-        return self.processes[ph.address].name
-
-    def get_threads(self, ph):
-        for address in sorted(self.processes[ph.address].threads.keys()):
-            assert isinstance(address, ThreadAddress)
-            yield ThreadHandle(address=address, inner={})
-
-    def extract_thread_features(self, ph, th):
-        for addr, feature in self.processes[ph.address].threads[th.address].features:
-            yield feature, addr
-
-    def get_calls(self, ph, th):
-        for address in sorted(self.processes[ph.address].threads[th.address].calls.keys()):
-            assert isinstance(address, DynamicCallAddress)
-            yield CallHandle(address=address, inner={})
-
-    def extract_call_features(self, ph, th, ch):
-        for address, feature in self.processes[ph.address].threads[th.address].calls[ch.address].features:
-            yield feature, address
-
-    def get_call_name(self, ph, th, ch) -> str:
-        return self.processes[ph.address].threads[th.address].calls[ch.address].name
-
-
-NullFeatureExtractor: TypeAlias = Union[NullStaticFeatureExtractor, NullDynamicFeatureExtractor]
--- a/capa/features/extractors/pefile.py
+++ b/capa/features/extractors/pefile.py
@@ -19,7 +19,7 @@ import capa.features.extractors.strings
 from capa.features.file import Export, Import, Section
 from capa.features.common import OS, ARCH_I386, FORMAT_PE, ARCH_AMD64, OS_WINDOWS, Arch, Format, Characteristic
 from capa.features.address import NO_ADDRESS, FileOffsetAddress, AbsoluteVirtualAddress
-from capa.features.extractors.base_extractor import SampleHashes, StaticFeatureExtractor
+from capa.features.extractors.base_extractor import FeatureExtractor

 logger = logging.getLogger(__name__)

@@ -84,7 +84,7 @@ def extract_file_import_names(pe, **kwargs):
                    except UnicodeDecodeError:
                        continue

-                for name in capa.features.extractors.helpers.generate_symbols(modname, impname, include_dll=True):
+                for name in capa.features.extractors.helpers.generate_symbols(modname, impname):
                    yield Import(name), AbsoluteVirtualAddress(imp.address)


@@ -185,9 +185,9 @@ GLOBAL_HANDLERS = (
 )


-class PefileFeatureExtractor(StaticFeatureExtractor):
+class PefileFeatureExtractor(FeatureExtractor):
    def __init__(self, path: Path):
-        super().__init__(hashes=SampleHashes.from_bytes(path.read_bytes()))
+        super().__init__()
        self.path: Path = path
        self.pe = pefile.PE(str(path))

--- a/capa/features/extractors/viv/basicblock.py
+++ b/capa/features/extractors/viv/basicblock.py
@@ -140,7 +140,7 @@ def is_printable_ascii(chars: bytes) -> bool:


 def is_printable_utf16le(chars: bytes) -> bool:
-    if all(c == 0x0 for c in chars[1::2]):
+    if all(c == b"\x00" for c in chars[1::2]):
        return is_printable_ascii(chars[::2])
    return False

--- a/capa/features/extractors/viv/extractor.py
+++ b/capa/features/extractors/viv/extractor.py
@@ -20,23 +20,17 @@ import capa.features.extractors.viv.function
 import capa.features.extractors.viv.basicblock
 from capa.features.common import Feature
 from capa.features.address import Address, AbsoluteVirtualAddress
-from capa.features.extractors.base_extractor import (
-    BBHandle,
-    InsnHandle,
-    SampleHashes,
-    FunctionHandle,
-    StaticFeatureExtractor,
-)
+from capa.features.extractors.base_extractor import BBHandle, InsnHandle, FunctionHandle, FeatureExtractor

 logger = logging.getLogger(__name__)


-class VivisectFeatureExtractor(StaticFeatureExtractor):
+class VivisectFeatureExtractor(FeatureExtractor):
    def __init__(self, vw, path: Path, os):
+        super().__init__()
        self.vw = vw
        self.path = path
        self.buf = path.read_bytes()
-        super().__init__(hashes=SampleHashes.from_bytes(self.buf))

        # pre-compute these because we'll yield them at *every* scope.
        self.global_features: List[Tuple[Feature, Address]] = []
--- a/capa/features/extractors/viv/file.py
+++ b/capa/features/extractors/viv/file.py
@@ -73,7 +73,7 @@ def extract_file_import_names(vw, **kwargs) -> Iterator[Tuple[Feature, Address]]
            impname = "#" + impname[len("ord") :]

        addr = AbsoluteVirtualAddress(va)
-        for name in capa.features.extractors.helpers.generate_symbols(modname, impname, include_dll=True):
+        for name in capa.features.extractors.helpers.generate_symbols(modname, impname):
            yield Import(name), addr


--- a/capa/features/extractors/viv/function.py
+++ b/capa/features/extractors/viv/function.py
@@ -38,7 +38,7 @@ def extract_function_symtab_names(fh: FunctionHandle) -> Iterator[Tuple[Feature,
        # this is in order to eliminate the computational overhead of refetching symtab each time.
        if "symtab" not in fh.ctx["cache"]:
            try:
-                fh.ctx["cache"]["symtab"] = SymTab.from_viv(fh.inner.vw.parsedbin)
+                fh.ctx["cache"]["symtab"] = SymTab.from_Elf(fh.inner.vw.parsedbin)
            except Exception:
                fh.ctx["cache"]["symtab"] = None

--- a/capa/features/extractors/viv/insn.py
+++ b/capa/features/extractors/viv/insn.py
@@ -115,7 +115,7 @@ def extract_insn_api_features(fh: FunctionHandle, bb, ih: InsnHandle) -> Iterato
                # the symbol table gets stored as a function's attribute in order to avoid running
                # this code everytime the call is made, thus preventing the computational overhead.
                try:
-                    fh.ctx["cache"]["symtab"] = SymTab.from_viv(f.vw.parsedbin)
+                    fh.ctx["cache"]["symtab"] = SymTab.from_Elf(f.vw.parsedbin)
                except Exception:
                    fh.ctx["cache"]["symtab"] = None

--- a/capa/features/freeze/init.py
+++ b/capa/features/freeze/init.py
@@ -9,17 +9,12 @@ Unless required by applicable law or agreed to in writing, software distributed
 is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and limitations under the License.
 """
-import json
 import zlib
 import logging
 from enum import Enum
-from typing import List, Tuple, Union, Literal
+from typing import List, Tuple, Union

-from pydantic import Field, BaseModel, ConfigDict
-
-# TODO(williballenthin): use typing.TypeAlias directly in Python 3.10+
-# https://github.com/mandiant/capa/issues/1699
-from typing_extensions import TypeAlias
+from pydantic import Field, BaseModel

 import capa.helpers
 import capa.version
@@ -28,23 +23,16 @@ import capa.features.insn
 import capa.features.common
 import capa.features.address
 import capa.features.basicblock
-import capa.features.extractors.null as null
+import capa.features.extractors.base_extractor
 from capa.helpers import assert_never
 from capa.features.freeze.features import Feature, feature_from_capa
-from capa.features.extractors.base_extractor import (
-    SampleHashes,
-    FeatureExtractor,
-    StaticFeatureExtractor,
-    DynamicFeatureExtractor,
-)

 logger = logging.getLogger(__name__)

-CURRENT_VERSION = 3
-

 class HashableModel(BaseModel):
-    model_config = ConfigDict(frozen=True)
+    class Config:
+        frozen = True


 class AddressType(str, Enum):
@@ -53,17 +41,12 @@ class AddressType(str, Enum):
    FILE = "file"
    DN_TOKEN = "dn token"
    DN_TOKEN_OFFSET = "dn token offset"
-    DEX_METHOD_INDEX = "dex method index"
-    DEX_CLASS_INDEX = "dex class index"
-    PROCESS = "process"
-    THREAD = "thread"
-    CALL = "call"
    NO_ADDRESS = "no address"


 class Address(HashableModel):
    type: AddressType
-    value: Union[int, Tuple[int, ...], None] = None  # None default value to support deserialization of NO_ADDRESS
+    value: Union[int, Tuple[int, int], None]

    @classmethod
    def from_capa(cls, a: capa.features.address.Address) -> "Address":
@@ -82,21 +65,6 @@ class Address(HashableModel):
        elif isinstance(a, capa.features.address.DNTokenOffsetAddress):
            return cls(type=AddressType.DN_TOKEN_OFFSET, value=(a.token, a.offset))

-        elif isinstance(a, capa.features.address.DexMethodAddress):
-            return cls(type=AddressType.DEX_METHOD_INDEX, value=int(a))
-
-        elif isinstance(a, capa.features.address.DexClassAddress):
-            return cls(type=AddressType.DEX_CLASS_INDEX, value=int(a))
-
-        elif isinstance(a, capa.features.address.ProcessAddress):
-            return cls(type=AddressType.PROCESS, value=(a.ppid, a.pid))
-
-        elif isinstance(a, capa.features.address.ThreadAddress):
-            return cls(type=AddressType.THREAD, value=(a.process.ppid, a.process.pid, a.tid))
-
-        elif isinstance(a, capa.features.address.DynamicCallAddress):
-            return cls(type=AddressType.CALL, value=(a.thread.process.ppid, a.thread.process.pid, a.thread.tid, a.id))
-
        elif a == capa.features.address.NO_ADDRESS or isinstance(a, capa.features.address._NoAddress):
            return cls(type=AddressType.NO_ADDRESS, value=None)

@@ -133,41 +101,6 @@ class Address(HashableModel):
            assert isinstance(offset, int)
            return capa.features.address.DNTokenOffsetAddress(token, offset)

-        elif self.type is AddressType.DEX_METHOD_INDEX:
-            assert isinstance(self.value, int)
-            return capa.features.address.DexMethodAddress(self.value)
-
-        elif self.type is AddressType.DEX_CLASS_INDEX:
-            assert isinstance(self.value, int)
-            return capa.features.address.DexClassAddress(self.value)
-
-        elif self.type is AddressType.PROCESS:
-            assert isinstance(self.value, tuple)
-            ppid, pid = self.value
-            assert isinstance(ppid, int)
-            assert isinstance(pid, int)
-            return capa.features.address.ProcessAddress(ppid=ppid, pid=pid)
-
-        elif self.type is AddressType.THREAD:
-            assert isinstance(self.value, tuple)
-            ppid, pid, tid = self.value
-            assert isinstance(ppid, int)
-            assert isinstance(pid, int)
-            assert isinstance(tid, int)
-            return capa.features.address.ThreadAddress(
-                process=capa.features.address.ProcessAddress(ppid=ppid, pid=pid), tid=tid
-            )
-
-        elif self.type is AddressType.CALL:
-            assert isinstance(self.value, tuple)
-            ppid, pid, tid, id_ = self.value
-            return capa.features.address.DynamicCallAddress(
-                thread=capa.features.address.ThreadAddress(
-                    process=capa.features.address.ProcessAddress(ppid=ppid, pid=pid), tid=tid
-                ),
-                id=id_,
-            )
-
        elif self.type is AddressType.NO_ADDRESS:
            return capa.features.address.NO_ADDRESS

@@ -198,48 +131,6 @@ class FileFeature(HashableModel):
    feature: Feature


-class ProcessFeature(HashableModel):
-    """
-    args:
-        process: the address of the process to which this feature belongs.
-        address: the address at which this feature is found.
-
-    process != address because, e.g., the feature may be found *within* the scope (process).
-    """
-
-    process: Address
-    address: Address
-    feature: Feature
-
-
-class ThreadFeature(HashableModel):
-    """
-    args:
-        thread: the address of the thread to which this feature belongs.
-        address: the address at which this feature is found.
-
-    thread != address because, e.g., the feature may be found *within* the scope (thread).
-    """
-
-    thread: Address
-    address: Address
-    feature: Feature
-
-
-class CallFeature(HashableModel):
-    """
-    args:
-        call: the address of the call to which this feature belongs.
-        address: the address at which this feature is found.
-
-    call != address for consistency with Process and Thread.
-    """
-
-    call: Address
-    address: Address
-    feature: Feature
-
-
 class FunctionFeature(HashableModel):
    """
    args:
@@ -268,7 +159,9 @@ class BasicBlockFeature(HashableModel):
    basic_block: Address = Field(alias="basic block")
    address: Address
    feature: Feature
-    model_config = ConfigDict(populate_by_name=True)
+
+    class Config:
+        allow_population_by_field_name = True


 class InstructionFeature(HashableModel):
@@ -277,7 +170,8 @@ class InstructionFeature(HashableModel):
        instruction: the address of the instruction to which this feature belongs.
        address: the address at which this feature is found.

-    instruction != address because, for consistency with Function and BasicBlock.
+    instruction != address because, e.g., the feature may be found *within* the scope (basic block),
+    versus right at its starting address.
    """

    instruction: Address
@@ -300,65 +194,43 @@ class FunctionFeatures(BaseModel):
    address: Address
    features: Tuple[FunctionFeature, ...]
    basic_blocks: Tuple[BasicBlockFeatures, ...] = Field(alias="basic blocks")
-    model_config = ConfigDict(populate_by_name=True)
+
+    class Config:
+        allow_population_by_field_name = True


-class CallFeatures(BaseModel):
-    address: Address
-    name: str
-    features: Tuple[CallFeature, ...]
-
-
-class ThreadFeatures(BaseModel):
-    address: Address
-    features: Tuple[ThreadFeature, ...]
-    calls: Tuple[CallFeatures, ...]
-
-
-class ProcessFeatures(BaseModel):
-    address: Address
-    name: str
-    features: Tuple[ProcessFeature, ...]
-    threads: Tuple[ThreadFeatures, ...]
-
-
-class StaticFeatures(BaseModel):
+class Features(BaseModel):
    global_: Tuple[GlobalFeature, ...] = Field(alias="global")
    file: Tuple[FileFeature, ...]
    functions: Tuple[FunctionFeatures, ...]
-    model_config = ConfigDict(populate_by_name=True)

-
-class DynamicFeatures(BaseModel):
-    global_: Tuple[GlobalFeature, ...] = Field(alias="global")
-    file: Tuple[FileFeature, ...]
-    processes: Tuple[ProcessFeatures, ...]
-    model_config = ConfigDict(populate_by_name=True)
-
-
-Features: TypeAlias = Union[StaticFeatures, DynamicFeatures]
+    class Config:
+        allow_population_by_field_name = True


 class Extractor(BaseModel):
    name: str
    version: str = capa.version.__version__
-    model_config = ConfigDict(populate_by_name=True)
+
+    class Config:
+        allow_population_by_field_name = True


 class Freeze(BaseModel):
-    version: int = CURRENT_VERSION
+    version: int = 2
    base_address: Address = Field(alias="base address")
-    sample_hashes: SampleHashes
-    flavor: Literal["static", "dynamic"]
    extractor: Extractor
    features: Features
-    model_config = ConfigDict(populate_by_name=True)
+
+    class Config:
+        allow_population_by_field_name = True


-def dumps_static(extractor: StaticFeatureExtractor) -> str:
+def dumps(extractor: capa.features.extractors.base_extractor.FeatureExtractor) -> str:
    """
    serialize the given extractor to a string
    """
+
    global_features: List[GlobalFeature] = []
    for feature, _ in extractor.extract_global_features():
        global_features.append(
@@ -437,7 +309,7 @@ def dumps_static(extractor: StaticFeatureExtractor) -> str:
            # Mypy is unable to recognise `basic_blocks` as a argument due to alias
        )

-    features = StaticFeatures(
+    features = Features(
        global_=global_features,
        file=tuple(file_features),
        functions=tuple(function_features),
@@ -445,139 +317,26 @@ def dumps_static(extractor: StaticFeatureExtractor) -> str:
    # Mypy is unable to recognise `global_` as a argument due to alias

    freeze = Freeze(
-        version=CURRENT_VERSION,
+        version=2,
        base_address=Address.from_capa(extractor.get_base_address()),
-        sample_hashes=extractor.get_sample_hashes(),
-        flavor="static",
        extractor=Extractor(name=extractor.__class__.__name__),
        features=features,
    )  # type: ignore
    # Mypy is unable to recognise `base_address` as a argument due to alias

-    return freeze.model_dump_json()
+    return freeze.json()


-def dumps_dynamic(extractor: DynamicFeatureExtractor) -> str:
-    """
-    serialize the given extractor to a string
-    """
-    global_features: List[GlobalFeature] = []
-    for feature, _ in extractor.extract_global_features():
-        global_features.append(
-            GlobalFeature(
-                feature=feature_from_capa(feature),
-            )
-        )
+def loads(s: str) -> capa.features.extractors.base_extractor.FeatureExtractor:
+    """deserialize a set of features (as a NullFeatureExtractor) from a string."""
+    import capa.features.extractors.null as null

-    file_features: List[FileFeature] = []
-    for feature, address in extractor.extract_file_features():
-        file_features.append(
-            FileFeature(
-                feature=feature_from_capa(feature),
-                address=Address.from_capa(address),
-            )
-        )
-
-    process_features: List[ProcessFeatures] = []
-    for p in extractor.get_processes():
-        paddr = Address.from_capa(p.address)
-        pname = extractor.get_process_name(p)
-        pfeatures = [
-            ProcessFeature(
-                process=paddr,
-                address=Address.from_capa(addr),
-                feature=feature_from_capa(feature),
-            )
-            for feature, addr in extractor.extract_process_features(p)
-        ]
-
-        threads = []
-        for t in extractor.get_threads(p):
-            taddr = Address.from_capa(t.address)
-            tfeatures = [
-                ThreadFeature(
-                    basic_block=taddr,
-                    address=Address.from_capa(addr),
-                    feature=feature_from_capa(feature),
-                )  # type: ignore
-                # Mypy is unable to recognise `basic_block` as a argument due to alias
-                for feature, addr in extractor.extract_thread_features(p, t)
-            ]
-
-            calls = []
-            for call in extractor.get_calls(p, t):
-                caddr = Address.from_capa(call.address)
-                cname = extractor.get_call_name(p, t, call)
-                cfeatures = [
-                    CallFeature(
-                        call=caddr,
-                        address=Address.from_capa(addr),
-                        feature=feature_from_capa(feature),
-                    )
-                    for feature, addr in extractor.extract_call_features(p, t, call)
-                ]
-
-                calls.append(
-                    CallFeatures(
-                        address=caddr,
-                        name=cname,
-                        features=tuple(cfeatures),
-                    )
-                )
-
-            threads.append(
-                ThreadFeatures(
-                    address=taddr,
-                    features=tuple(tfeatures),
-                    calls=tuple(calls),
-                )
-            )
-
-        process_features.append(
-            ProcessFeatures(
-                address=paddr,
-                name=pname,
-                features=tuple(pfeatures),
-                threads=tuple(threads),
-            )
-        )
-
-    features = DynamicFeatures(
-        global_=global_features,
-        file=tuple(file_features),
-        processes=tuple(process_features),
-    )  # type: ignore
-    # Mypy is unable to recognise `global_` as a argument due to alias
-
-    # workaround around mypy issue: https://github.com/python/mypy/issues/1424
-    get_base_addr = getattr(extractor, "get_base_addr", None)
-    base_addr = get_base_addr() if get_base_addr else capa.features.address.NO_ADDRESS
-
-    freeze = Freeze(
-        version=CURRENT_VERSION,
-        base_address=Address.from_capa(base_addr),
-        sample_hashes=extractor.get_sample_hashes(),
-        flavor="dynamic",
-        extractor=Extractor(name=extractor.__class__.__name__),
-        features=features,
-    )  # type: ignore
-    # Mypy is unable to recognise `base_address` as a argument due to alias
-
-    return freeze.model_dump_json()
-
-
-def loads_static(s: str) -> StaticFeatureExtractor:
-    """deserialize a set of features (as a NullStaticFeatureExtractor) from a string."""
-    freeze = Freeze.model_validate_json(s)
-    if freeze.version != CURRENT_VERSION:
+    freeze = Freeze.parse_raw(s)
+    if freeze.version != 2:
        raise ValueError(f"unsupported freeze format version: {freeze.version}")

-    assert freeze.flavor == "static"
-    assert isinstance(freeze.features, StaticFeatures)
-
-    return null.NullStaticFeatureExtractor(
+    return null.NullFeatureExtractor(
        base_address=freeze.base_address.to_capa(),
-        sample_hashes=freeze.sample_hashes,
        global_features=[f.feature.to_capa() for f in freeze.features.global_],
        file_features=[(f.address.to_capa(), f.feature.to_capa()) for f in freeze.features.file],
        functions={
@@ -601,59 +360,10 @@ def loads_static(s: str) -> StaticFeatureExtractor:
    )


-def loads_dynamic(s: str) -> DynamicFeatureExtractor:
-    """deserialize a set of features (as a NullDynamicFeatureExtractor) from a string."""
-    freeze = Freeze.model_validate_json(s)
-    if freeze.version != CURRENT_VERSION:
-        raise ValueError(f"unsupported freeze format version: {freeze.version}")
-
-    assert freeze.flavor == "dynamic"
-    assert isinstance(freeze.features, DynamicFeatures)
-
-    return null.NullDynamicFeatureExtractor(
-        base_address=freeze.base_address.to_capa(),
-        sample_hashes=freeze.sample_hashes,
-        global_features=[f.feature.to_capa() for f in freeze.features.global_],
-        file_features=[(f.address.to_capa(), f.feature.to_capa()) for f in freeze.features.file],
-        processes={
-            p.address.to_capa(): null.ProcessFeatures(
-                name=p.name,
-                features=[(fe.address.to_capa(), fe.feature.to_capa()) for fe in p.features],
-                threads={
-                    t.address.to_capa(): null.ThreadFeatures(
-                        features=[(fe.address.to_capa(), fe.feature.to_capa()) for fe in t.features],
-                        calls={
-                            c.address.to_capa(): null.CallFeatures(
-                                name=c.name,
-                                features=[(fe.address.to_capa(), fe.feature.to_capa()) for fe in c.features],
-                            )
-                            for c in t.calls
-                        },
-                    )
-                    for t in p.threads
-                },
-            )
-            for p in freeze.features.processes
-        },
-    )
-
-
 MAGIC = "capa0000".encode("ascii")


-def dumps(extractor: FeatureExtractor) -> str:
-    """serialize the given extractor to a string."""
-    if isinstance(extractor, StaticFeatureExtractor):
-        doc = dumps_static(extractor)
-    elif isinstance(extractor, DynamicFeatureExtractor):
-        doc = dumps_dynamic(extractor)
-    else:
-        raise ValueError("Invalid feature extractor")
-
-    return doc
-
-
-def dump(extractor: FeatureExtractor) -> bytes:
+def dump(extractor: capa.features.extractors.base_extractor.FeatureExtractor) -> bytes:
    """serialize the given extractor to a byte array."""
    return MAGIC + zlib.compress(dumps(extractor).encode("utf-8"))

@@ -662,28 +372,11 @@ def is_freeze(buf: bytes) -> bool:
    return buf[: len(MAGIC)] == MAGIC


-def loads(s: str):
-    doc = json.loads(s)
-
-    if doc["version"] != CURRENT_VERSION:
-        raise ValueError(f"unsupported freeze format version: {doc['version']}")
-
-    if doc["flavor"] == "static":
-        return loads_static(s)
-    elif doc["flavor"] == "dynamic":
-        return loads_dynamic(s)
-    else:
-        raise ValueError(f"unsupported freeze format flavor: {doc['flavor']}")
-
-
-def load(buf: bytes):
+def load(buf: bytes) -> capa.features.extractors.base_extractor.FeatureExtractor:
    """deserialize a set of features (as a NullFeatureExtractor) from a byte array."""
    if not is_freeze(buf):
        raise ValueError("missing magic header")
-
-    s = zlib.decompress(buf[len(MAGIC) :]).decode("utf-8")
-
-    return loads(s)
+    return loads(zlib.decompress(buf[len(MAGIC) :]).decode("utf-8"))


 def main(argv=None):
--- a/capa/features/freeze/features.py
+++ b/capa/features/freeze/features.py
@@ -8,7 +8,7 @@
 import binascii
 from typing import Union, Optional

-from pydantic import Field, BaseModel, ConfigDict
+from pydantic import Field, BaseModel

 import capa.features.file
 import capa.features.insn
@@ -17,7 +17,9 @@ import capa.features.basicblock


 class FeatureModel(BaseModel):
-    model_config = ConfigDict(frozen=True, populate_by_name=True)
+    class Config:
+        frozen = True
+        allow_population_by_field_name = True

    def to_capa(self) -> capa.features.common.Feature:
        if isinstance(self, OSFeature):
@@ -211,141 +213,141 @@ def feature_from_capa(f: capa.features.common.Feature) -> "Feature":
 class OSFeature(FeatureModel):
    type: str = "os"
    os: str
-    description: Optional[str] = None
+    description: Optional[str]


 class ArchFeature(FeatureModel):
    type: str = "arch"
    arch: str
-    description: Optional[str] = None
+    description: Optional[str]


 class FormatFeature(FeatureModel):
    type: str = "format"
    format: str
-    description: Optional[str] = None
+    description: Optional[str]


 class MatchFeature(FeatureModel):
    type: str = "match"
    match: str
-    description: Optional[str] = None
+    description: Optional[str]


 class CharacteristicFeature(FeatureModel):
    type: str = "characteristic"
    characteristic: str
-    description: Optional[str] = None
+    description: Optional[str]


 class ExportFeature(FeatureModel):
    type: str = "export"
    export: str
-    description: Optional[str] = None
+    description: Optional[str]


 class ImportFeature(FeatureModel):
    type: str = "import"
    import_: str = Field(alias="import")
-    description: Optional[str] = None
+    description: Optional[str]


 class SectionFeature(FeatureModel):
    type: str = "section"
    section: str
-    description: Optional[str] = None
+    description: Optional[str]


 class FunctionNameFeature(FeatureModel):
    type: str = "function name"
    function_name: str = Field(alias="function name")
-    description: Optional[str] = None
+    description: Optional[str]


 class SubstringFeature(FeatureModel):
    type: str = "substring"
    substring: str
-    description: Optional[str] = None
+    description: Optional[str]


 class RegexFeature(FeatureModel):
    type: str = "regex"
    regex: str
-    description: Optional[str] = None
+    description: Optional[str]


 class StringFeature(FeatureModel):
    type: str = "string"
    string: str
-    description: Optional[str] = None
+    description: Optional[str]


 class ClassFeature(FeatureModel):
    type: str = "class"
    class_: str = Field(alias="class")
-    description: Optional[str] = None
+    description: Optional[str]


 class NamespaceFeature(FeatureModel):
    type: str = "namespace"
    namespace: str
-    description: Optional[str] = None
+    description: Optional[str]


 class BasicBlockFeature(FeatureModel):
    type: str = "basic block"
-    description: Optional[str] = None
+    description: Optional[str]


 class APIFeature(FeatureModel):
    type: str = "api"
    api: str
-    description: Optional[str] = None
+    description: Optional[str]


 class PropertyFeature(FeatureModel):
    type: str = "property"
-    access: Optional[str] = None
+    access: Optional[str]
    property: str
-    description: Optional[str] = None
+    description: Optional[str]


 class NumberFeature(FeatureModel):
    type: str = "number"
    number: Union[int, float]
-    description: Optional[str] = None
+    description: Optional[str]


 class BytesFeature(FeatureModel):
    type: str = "bytes"
    bytes: str
-    description: Optional[str] = None
+    description: Optional[str]


 class OffsetFeature(FeatureModel):
    type: str = "offset"
    offset: int
-    description: Optional[str] = None
+    description: Optional[str]


 class MnemonicFeature(FeatureModel):
    type: str = "mnemonic"
    mnemonic: str
-    description: Optional[str] = None
+    description: Optional[str]


 class OperandNumberFeature(FeatureModel):
    type: str = "operand number"
    index: int
    operand_number: int = Field(alias="operand number")
-    description: Optional[str] = None
+    description: Optional[str]


 class OperandOffsetFeature(FeatureModel):
    type: str = "operand offset"
    index: int
    operand_offset: int = Field(alias="operand offset")
-    description: Optional[str] = None
+    description: Optional[str]


 Feature = Union[
--- a/capa/ghidra/README.md
+++ b/capa/ghidra/README.md
@@ -1,172 +0,0 @@
-<div align="center">
-    <img src="/doc/img/ghidra_backend_logo.png" width=300 height=175>
-</div>
-
-The Ghidra feature extractor is an application of the FLARE team's open-source project, Ghidrathon, to integrate capa with Ghidra using Python 3. capa is a framework that uses a well-defined collection of rules to identify capabilities in a program. You can run capa against a PE file, ELF file, or shellcode and it tells you what it thinks the program can do. For example, it might suggest that the program is a backdoor, can install services, or relies on HTTP to communicate. The Ghidra feature extractor can be used to run capa analysis on your Ghidra databases without needing access to the original binary file.
-
-<img src="/doc/img/ghidra_script_mngr_output.png">
-
-## Getting Started
-
-### Installation
-
-Please ensure that you have the following dependencies installed before continuing:
-
-| Dependency | Version | Source |
-|------------|---------|--------|
-| Ghidrathon | `>= 3.0.0` | https://github.com/mandiant/Ghidrathon |
-| Python | `>= 3.8` | https://www.python.org/downloads |
-| Ghidra | `>= 10.2` | https://ghidra-sre.org |
-
-In order to run capa using using Ghidra, you must install capa as a library, obtain the official capa rules that match the capa version you have installed, and configure the Python 3 script [capa_ghidra.py](/capa/ghidra/capa_ghidra.py). You can do this by completing the following steps using the Python 3 interpreter that you have configured for your Ghidrathon installation:
-
-1. Install capa and its dependencies from PyPI using the following command:
-```bash
-$ pip install flare-capa
-```
-
-2. Download and extract the [official capa rules](https://github.com/mandiant/capa-rules/releases) that match the capa version you have installed. Use the following command to view the version of capa you have installed:
-```bash
-$ pip show flare-capa
-OR
-$ capa --version
-```
-
-3. Copy [capa_ghidra.py](/capa/ghidra/capa_ghidra.py) to your `$USER_HOME/ghidra_scripts` directory or manually add `</path/to/ghidra_capa.py/>` to the Ghidra Script Manager.
-
-## Usage
-
-After completing the installation steps you can execute `capa_ghidra.py` using the Ghidra Script Manager or Headless Analyzer.
-
-### Ghidra Script Manager
-
-To execute `capa_ghidra.py` using the Ghidra Script Manager, first open the Ghidra Script Manager by navigating to `Window > Script Manager` in the Ghidra Code Browser. Next, locate `capa_ghidra.py` by selecting the `Python 3 > capa` category or using the Ghidra Script Manager search funtionality. Finally, double-click `capa_ghidra.py` to execute the script. If you don't see `capa_ghidra.py`, make sure you have copied the script to your `$USER_HOME/ghidra_scripts` directory or manually added `</path/to/ghidra_capa.py/>` to the Ghidra Script Manager
-
-When executed, `capa_ghidra.py` asks you to provide your capa rules directory and preferred output format. `capa_ghidra.py` supports `default`, `verbose`, and `vverbose` output formats when executed from the Ghidra Script Manager. `capa_ghidra.py` writes output to the Ghidra Console Window.
-
-#### Example
-
-The following is an example of running `capa_ghidra.py` using the Ghidra Script Manager:
-
-Selecting capa rules:
-<img src="/doc/img/ghidra_script_mngr_rules.png">
-
-Choosing output format:
-<img src="/doc/img/ghidra_script_mngr_verbosity.png">
-
-Viewing results in Ghidra Console Window:
-<img src="/doc/img/ghidra_script_mngr_output.png">
-
-### Ghidra Headless Analyzer
-
-To execute `capa_ghidra.py` using the Ghidra Headless Analyzer, you can use the Ghidra `analyzeHeadless` script located in your `$GHIDRA_HOME/support` directory. You will need to provide the following arguments to the Ghidra `analyzeHeadless` script:
-
-1. `</path/to/ghidra/project/>`: path to Ghidra project
-2. `<ghidra_project_name>`: name of Ghidra Project
-3. `-process <sample_name>`: name of sample `<sample_name>`
-4. `-ScriptPath </path/to/capa_ghidra/>`: OPTIONAL argument specifying path `</path/to/capa_ghidra/>` to `capa_ghidra.py`
-5. `-PostScript capa_ghidra.py`: executes `capa_ghidra.py` as post-analysis script
-6. `"<capa_args>"`: single, quoted string containing capa arguments that must specify capa rules directory and output format, e.g. `"<path/to/capa/rules> --verbose"`. `capa_ghidra.py` supports `default`, `verbose`, `vverbose` and `json` formats when executed using the Ghidra Headless Analyzer. `capa_ghidra.py` writes output to the console window used to execute the Ghidra `analyzeHeadless` script.
-7. `-processor <languageID>`: required ONLY if sample `<sample_name>` is shellcode. More information on specifying the `<languageID>` can be found in the `$GHIDRA_HOME/support/analyzeHeadlessREADME.html` documentation.
-
-The following is an example of combining these arguments into a single `analyzeHeadless` script command:
-
-```
-$GHIDRA_HOME/support/analyzeHeadless </path/to/ghidra/project/> <ghidra_project_name> -process <sample_name> -PostScript capa_ghidra.py "/path/to/capa/rules/ --verbose"
-```
-
-You may also want to run capa against a sample that you have not yet imported into your Ghidra project. The following is an example of importing a sample and running `capa_ghidra.py` using a single `analyzeHeadless` script command:
-
-```
-$GHIDRA_HOME/support/analyzeHeadless </path/to/ghidra/project/> <ghidra_project_name> -Import </path/to/sample> -PostScript capa_ghidra.py "/path/to/capa/rules/ --verbose"
-```
-
-You can also provide `capa_ghidra.py` the single argument `"help"` to view supported arguments when running the script using the Ghidra Headless Analyzer:
-```
-$GHIDRA_HOME/support/analyzeHeadless </path/to/ghidra/project/> <ghidra_project_name> -process <sample_name> -PostScript capa_ghidra.py "help"
-```
-
-#### Example
-
-The following is an example of running `capa_ghidra.py` against a shellcode sample using the Ghidra `analyzeHeadless` script:
-```
-$ analyzeHeadless /home/wumbo/Desktop/ghidra_projects/ capa_test -process 499c2a85f6e8142c3f48d4251c9c7cd6.raw32 -processor x86:LE:32:default -PostScript capa_ghidra.py "/home/wumbo/capa/rules -vv"
-[...]
-
-INFO  REPORT: Analysis succeeded for file: /499c2a85f6e8142c3f48d4251c9c7cd6.raw32 (HeadlessAnalyzer)  
-INFO  SCRIPT: /home/wumbo/ghidra_scripts/capa_ghidra.py (HeadlessAnalyzer)  
-md5                     499c2a85f6e8142c3f48d4251c9c7cd6                                                                                                                                                                                                    
-sha1
-sha256                  e8e02191c1b38c808d27a899ac164b3675eb5cadd3a8907b0ffa863714000e72
-path                    /home/wumbo/capa/tests/data/499c2a85f6e8142c3f48d4251c9c7cd6.raw32
-timestamp               2023-08-29 17:57:00.946588
-capa version            6.1.0
-os                      unknown os
-format                  Raw Binary
-arch                    x86
-extractor               ghidra
-base address            global
-rules                   /home/wumbo/capa/rules
-function count          42
-library function count  0
-total feature count     1970
-
-contain loop (24 matches, only showing first match of library rule)
-author  moritz.raabe@mandiant.com
-scope   function
-function @ 0x0
-  or:
-    characteristic: loop @ 0x0
-    characteristic: tight loop @ 0x278
-
-contain obfuscated stackstrings
-namespace  anti-analysis/obfuscation/string/stackstring
-author     moritz.raabe@mandiant.com
-scope      basic block
-att&ck     Defense Evasion::Obfuscated Files or Information::Indicator Removal from Tools [T1027.005]
-mbc        Anti-Static Analysis::Executable Code Obfuscation::Argument Obfuscation [B0032.020], Anti-Static Analysis::Executable Code Obfuscation::Stack Strings [B0032.017]
-basic block @ 0x0 in function 0x0
-  characteristic: stack string @ 0x0
-
-encode data using XOR
-namespace  data-manipulation/encoding/xor
-author     moritz.raabe@mandiant.com
-scope      basic block
-att&ck     Defense Evasion::Obfuscated Files or Information [T1027]
-mbc        Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm [E1027.m02], Data::Encode Data::XOR [C0026.002]
-basic block @ 0x8AF in function 0x8A1
-  and:
-    characteristic: tight loop @ 0x8AF
-    characteristic: nzxor @ 0x8C0
-    not: = filter for potential false positives
-      or:
-        or: = unsigned bitwise negation operation (~i)
-          number: 0xFFFFFFFF = bitwise negation for unsigned 32 bits
-          number: 0xFFFFFFFFFFFFFFFF = bitwise negation for unsigned 64 bits
-        or: = signed bitwise negation operation (~i)
-          number: 0xFFFFFFF = bitwise negation for signed 32 bits
-          number: 0xFFFFFFFFFFFFFFF = bitwise negation for signed 64 bits
-        or: = Magic constants used in the implementation of strings functions.
-          number: 0x7EFEFEFF = optimized string constant for 32 bits
-          number: 0x81010101 = -0x81010101 = 0x7EFEFEFF
-          number: 0x81010100 = 0x81010100 = ~0x7EFEFEFF
-          number: 0x7EFEFEFEFEFEFEFF = optimized string constant for 64 bits
-          number: 0x8101010101010101 = -0x8101010101010101 = 0x7EFEFEFEFEFEFEFF
-          number: 0x8101010101010100 = 0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF
-
-get OS information via KUSER_SHARED_DATA
-namespace   host-interaction/os/version
-author      @mr-tz
-scope       function
-att&ck      Discovery::System Information Discovery [T1082]
-references  https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/ntexapi_x/kuser_shared_data/index.htm
-function @ 0x1CA6
-  or:
-    number: 0x7FFE026C = NtMajorVersion @ 0x1D18
-
-
-
-Script /home/wumbo/ghidra_scripts/capa_ghidra.py called exit with code 0
-
-[...]
-```
--- a/capa/ghidra/init.py
+++ b/capa/ghidra/init.py
--- a/capa/ghidra/capa_ghidra.py
+++ b/capa/ghidra/capa_ghidra.py
@@ -1,167 +0,0 @@
-# Run capa against loaded Ghidra database
-# @author Mike Hunhoff (mehunhoff@google.com)
-# @category Python 3.capa
-
-# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
-# Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at: [package root]/LICENSE.txt
-# Unless required by applicable law or agreed to in writing, software distributed under the License
-#  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and limitations under the License.
-import sys
-import logging
-import pathlib
-import argparse
-
-import capa
-import capa.main
-import capa.rules
-import capa.ghidra.helpers
-import capa.render.default
-import capa.capabilities.common
-import capa.features.extractors.ghidra.extractor
-
-logger = logging.getLogger("capa_ghidra")
-
-
-def run_headless():
-    parser = argparse.ArgumentParser(description="The FLARE team's open-source tool to integrate capa with Ghidra.")
-
-    parser.add_argument(
-        "rules",
-        type=str,
-        help="path to rule file or directory",
-    )
-    parser.add_argument(
-        "-v", "--verbose", action="store_true", help="enable verbose result document (no effect with --json)"
-    )
-    parser.add_argument(
-        "-vv", "--vverbose", action="store_true", help="enable very verbose result document (no effect with --json)"
-    )
-    parser.add_argument("-d", "--debug", action="store_true", help="enable debugging output on STDERR")
-    parser.add_argument("-q", "--quiet", action="store_true", help="disable all output but errors")
-    parser.add_argument("-j", "--json", action="store_true", help="emit JSON instead of text")
-
-    script_args = list(getScriptArgs())  # type: ignore [name-defined] # noqa: F821
-    if not script_args or len(script_args) > 1:
-        script_args = []
-    else:
-        script_args = script_args[0].split()
-        for idx, arg in enumerate(script_args):
-            if arg.lower() == "help":
-                script_args[idx] = "--help"
-
-    args = parser.parse_args(args=script_args)
-
-    if args.quiet:
-        logging.basicConfig(level=logging.WARNING)
-        logging.getLogger().setLevel(logging.WARNING)
-    elif args.debug:
-        logging.basicConfig(level=logging.DEBUG)
-        logging.getLogger().setLevel(logging.DEBUG)
-    else:
-        logging.basicConfig(level=logging.INFO)
-        logging.getLogger().setLevel(logging.INFO)
-
-    logger.debug("running in Ghidra headless mode")
-
-    rules_path = pathlib.Path(args.rules)
-
-    logger.debug("rule path: %s", rules_path)
-    rules = capa.main.get_rules([rules_path])
-
-    meta = capa.ghidra.helpers.collect_metadata([rules_path])
-    extractor = capa.features.extractors.ghidra.extractor.GhidraFeatureExtractor()
-
-    capabilities, counts = capa.capabilities.common.find_capabilities(rules, extractor, False)
-
-    meta.analysis.feature_counts = counts["feature_counts"]
-    meta.analysis.library_functions = counts["library_functions"]
-    meta.analysis.layout = capa.main.compute_layout(rules, extractor, capabilities)
-
-    if capa.capabilities.common.has_file_limitation(rules, capabilities, is_standalone=True):
-        logger.info("capa encountered warnings during analysis")
-
-    if args.json:
-        print(capa.render.json.render(meta, rules, capabilities))  # noqa: T201
-    elif args.vverbose:
-        print(capa.render.vverbose.render(meta, rules, capabilities))  # noqa: T201
-    elif args.verbose:
-        print(capa.render.verbose.render(meta, rules, capabilities))  # noqa: T201
-    else:
-        print(capa.render.default.render(meta, rules, capabilities))  # noqa: T201
-
-    return 0
-
-
-def run_ui():
-    logging.basicConfig(level=logging.INFO)
-    logging.getLogger().setLevel(logging.INFO)
-
-    rules_dir: str = ""
-    try:
-        selected_dir = askDirectory("Choose capa rules directory", "Ok")  # type: ignore [name-defined] # noqa: F821
-        if selected_dir:
-            rules_dir = selected_dir.getPath()
-    except RuntimeError:
-        # RuntimeError thrown when user selects "Cancel"
-        pass
-
-    if not rules_dir:
-        logger.info("You must choose a capa rules directory before running capa.")
-        return capa.main.E_MISSING_RULES
-
-    verbose = askChoice(  # type: ignore [name-defined] # noqa: F821
-        "capa output verbosity", "Choose capa output verbosity", ["default", "verbose", "vverbose"], "default"
-    )
-
-    rules_path: pathlib.Path = pathlib.Path(rules_dir)
-    logger.info("running capa using rules from %s", str(rules_path))
-
-    rules = capa.main.get_rules([rules_path])
-
-    meta = capa.ghidra.helpers.collect_metadata([rules_path])
-    extractor = capa.features.extractors.ghidra.extractor.GhidraFeatureExtractor()
-
-    capabilities, counts = capa.capabilities.common.find_capabilities(rules, extractor, True)
-
-    meta.analysis.feature_counts = counts["feature_counts"]
-    meta.analysis.library_functions = counts["library_functions"]
-    meta.analysis.layout = capa.main.compute_layout(rules, extractor, capabilities)
-
-    if capa.capabilities.common.has_file_limitation(rules, capabilities, is_standalone=False):
-        logger.info("capa encountered warnings during analysis")
-
-    if verbose == "vverbose":
-        print(capa.render.vverbose.render(meta, rules, capabilities))  # noqa: T201
-    elif verbose == "verbose":
-        print(capa.render.verbose.render(meta, rules, capabilities))  # noqa: T201
-    else:
-        print(capa.render.default.render(meta, rules, capabilities))  # noqa: T201
-
-    return 0
-
-
-def main():
-    if not capa.ghidra.helpers.is_supported_ghidra_version():
-        return capa.main.E_UNSUPPORTED_GHIDRA_VERSION
-
-    if not capa.ghidra.helpers.is_supported_file_type():
-        return capa.main.E_INVALID_FILE_TYPE
-
-    if not capa.ghidra.helpers.is_supported_arch_type():
-        return capa.main.E_INVALID_FILE_ARCH
-
-    if isRunningHeadless():  # type: ignore [name-defined] # noqa: F821
-        return run_headless()
-    else:
-        return run_ui()
-
-
-if __name__ == "__main__":
-    if sys.version_info < (3, 8):
-        from capa.exceptions import UnsupportedRuntimeError
-
-        raise UnsupportedRuntimeError("This version of capa can only be used with Python 3.8+")
-    sys.exit(main())
--- a/capa/ghidra/helpers.py
+++ b/capa/ghidra/helpers.py
@@ -1,160 +0,0 @@
-# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
-# Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at: [package root]/LICENSE.txt
-# Unless required by applicable law or agreed to in writing, software distributed under the License
-#  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and limitations under the License.
-import logging
-import datetime
-import contextlib
-from typing import List
-from pathlib import Path
-
-import capa
-import capa.version
-import capa.features.common
-import capa.features.freeze
-import capa.render.result_document as rdoc
-import capa.features.extractors.ghidra.helpers
-
-logger = logging.getLogger("capa")
-
-# file type as returned by Ghidra
-SUPPORTED_FILE_TYPES = ("Executable and Linking Format (ELF)", "Portable Executable (PE)", "Raw Binary")
-
-
-class GHIDRAIO:
-    """
-    An object that acts as a file-like object,
-    using bytes from the current Ghidra listing.
-    """
-
-    def __init__(self):
-        super().__init__()
-
-        self.offset = 0
-        self.bytes_ = self.get_bytes()
-
-    def seek(self, offset, whence=0):
-        assert whence == 0
-        self.offset = offset
-
-    def read(self, size):
-        logger.debug("reading 0x%x bytes at 0x%x (ea: 0x%x)", size, self.offset, currentProgram().getImageBase().add(self.offset).getOffset())  # type: ignore [name-defined] # noqa: F821
-
-        if size > len(self.bytes_) - self.offset:
-            logger.debug("cannot read 0x%x bytes at 0x%x (ea: BADADDR)", size, self.offset)
-            return b""
-        else:
-            return self.bytes_[self.offset : self.offset + size]
-
-    def close(self):
-        return
-
-    def get_bytes(self):
-        file_bytes = currentProgram().getMemory().getAllFileBytes()[0]  # type: ignore [name-defined] # noqa: F821
-
-        # getOriginalByte() allows for raw file parsing on the Ghidra side
-        # other functions will fail as Ghidra will think that it's reading uninitialized memory
-        bytes_ = [file_bytes.getOriginalByte(i) for i in range(file_bytes.getSize())]
-
-        return capa.features.extractors.ghidra.helpers.ints_to_bytes(bytes_)
-
-
-def is_supported_ghidra_version():
-    version = float(getGhidraVersion()[:4])  # type: ignore [name-defined] # noqa: F821
-    if version < 10.2:
-        warning_msg = "capa does not support this Ghidra version"
-        logger.warning(warning_msg)
-        logger.warning("Your Ghidra version is: %s. Supported versions are: Ghidra >= 10.2", version)
-        return False
-    return True
-
-
-def is_running_headless():
-    return isRunningHeadless()  # type: ignore [name-defined] # noqa: F821
-
-
-def is_supported_file_type():
-    file_info = currentProgram().getExecutableFormat()  # type: ignore [name-defined] # noqa: F821
-    if file_info not in SUPPORTED_FILE_TYPES:
-        logger.error("-" * 80)
-        logger.error(" Input file does not appear to be a supported file type.")
-        logger.error(" ")
-        logger.error(
-            " capa currently only supports analyzing PE, ELF, or binary files containing x86 (32- and 64-bit) shellcode."
-        )
-        logger.error(" If you don't know the input file type, you can try using the `file` utility to guess it.")
-        logger.error("-" * 80)
-        return False
-    return True
-
-
-def is_supported_arch_type():
-    lang_id = str(currentProgram().getLanguageID()).lower()  # type: ignore [name-defined] # noqa: F821
-
-    if not all((lang_id.startswith("x86"), any(arch in lang_id for arch in ("32", "64")))):
-        logger.error("-" * 80)
-        logger.error(" Input file does not appear to target a supported architecture.")
-        logger.error(" ")
-        logger.error(" capa currently only supports analyzing x86 (32- and 64-bit).")
-        logger.error("-" * 80)
-        return False
-    return True
-
-
-def get_file_md5():
-    return currentProgram().getExecutableMD5()  # type: ignore [name-defined] # noqa: F821
-
-
-def get_file_sha256():
-    return currentProgram().getExecutableSHA256()  # type: ignore [name-defined] # noqa: F821
-
-
-def collect_metadata(rules: List[Path]):
-    md5 = get_file_md5()
-    sha256 = get_file_sha256()
-
-    info = currentProgram().getLanguageID().toString()  # type: ignore [name-defined] # noqa: F821
-    if "x86" in info and "64" in info:
-        arch = "x86_64"
-    elif "x86" in info and "32" in info:
-        arch = "x86"
-    else:
-        arch = "unknown arch"
-
-    format_name: str = currentProgram().getExecutableFormat()  # type: ignore [name-defined] # noqa: F821
-    if "PE" in format_name:
-        os = "windows"
-    elif "ELF" in format_name:
-        with contextlib.closing(capa.ghidra.helpers.GHIDRAIO()) as f:
-            os = capa.features.extractors.elf.detect_elf_os(f)
-    else:
-        os = "unknown os"
-
-    return rdoc.Metadata(
-        timestamp=datetime.datetime.now(),
-        version=capa.version.__version__,
-        argv=(),
-        sample=rdoc.Sample(
-            md5=md5,
-            sha1="",
-            sha256=sha256,
-            path=currentProgram().getExecutablePath(),  # type: ignore [name-defined] # noqa: F821
-        ),
-        flavor=rdoc.Flavor.STATIC,
-        analysis=rdoc.StaticAnalysis(
-            format=currentProgram().getExecutableFormat(),  # type: ignore [name-defined] # noqa: F821
-            arch=arch,
-            os=os,
-            extractor="ghidra",
-            rules=tuple(r.resolve().absolute().as_posix() for r in rules),
-            base_address=capa.features.freeze.Address.from_capa(currentProgram().getImageBase().getOffset()),  # type: ignore [name-defined] # noqa: F821
-            layout=rdoc.StaticLayout(
-                functions=(),
-            ),
-            feature_counts=rdoc.StaticFeatureCounts(file=0, functions=()),
-            library_functions=(),
-        ),
-    )
--- a/capa/helpers.py
+++ b/capa/helpers.py
@@ -5,7 +5,6 @@
 # Unless required by applicable law or agreed to in writing, software distributed under the License
 #  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and limitations under the License.
-import json
 import inspect
 import logging
 import contextlib
@@ -16,11 +15,10 @@ from pathlib import Path
 import tqdm

 from capa.exceptions import UnsupportedFormatError
-from capa.features.common import FORMAT_PE, FORMAT_CAPE, FORMAT_SC32, FORMAT_SC64, FORMAT_DOTNET, FORMAT_UNKNOWN, Format
+from capa.features.common import FORMAT_PE, FORMAT_SC32, FORMAT_SC64, FORMAT_DOTNET, FORMAT_UNKNOWN, Format

 EXTENSIONS_SHELLCODE_32 = ("sc32", "raw32")
 EXTENSIONS_SHELLCODE_64 = ("sc64", "raw64")
-EXTENSIONS_DYNAMIC = ("json", "json_")
 EXTENSIONS_ELF = "elf_"

 logger = logging.getLogger("capa")
@@ -45,43 +43,18 @@ def is_runtime_ida():
    return importlib.util.find_spec("idc") is not None


-def is_runtime_ghidra():
-    try:
-        currentProgram  # type: ignore [name-defined] # noqa: F821
-    except NameError:
-        return False
-    return True
-
-
 def assert_never(value) -> NoReturn:
    # careful: python -O will remove this assertion.
    # but this is only used for type checking, so it's ok.
    assert False, f"Unhandled value: {value} ({type(value).__name__})"  # noqa: B011


-def get_format_from_report(sample: Path) -> str:
-    report = json.load(sample.open(encoding="utf-8"))
-
-    if "CAPE" in report:
-        return FORMAT_CAPE
-
-    if "target" in report and "info" in report and "behavior" in report:
-        # CAPE report that's missing the "CAPE" key,
-        # which is not going to be much use, but its correct.
-        return FORMAT_CAPE
-
-    return FORMAT_UNKNOWN
-
-
 def get_format_from_extension(sample: Path) -> str:
-    format_ = FORMAT_UNKNOWN
    if sample.name.endswith(EXTENSIONS_SHELLCODE_32):
-        format_ = FORMAT_SC32
+        return FORMAT_SC32
    elif sample.name.endswith(EXTENSIONS_SHELLCODE_64):
-        format_ = FORMAT_SC64
-    elif sample.name.endswith(EXTENSIONS_DYNAMIC):
-        format_ = get_format_from_report(sample)
-    return format_
+        return FORMAT_SC64
+    return FORMAT_UNKNOWN


 def get_auto_format(path: Path) -> str:
@@ -96,13 +69,13 @@ def get_auto_format(path: Path) -> str:
 def get_format(sample: Path) -> str:
    # imported locally to avoid import cycle
    from capa.features.extractors.common import extract_format
-    from capa.features.extractors.dotnetfile import DotnetFileFeatureExtractor
+    from capa.features.extractors.dnfile_ import DnfileFeatureExtractor

    buf = sample.read_bytes()

    for feature, _ in extract_format(buf):
        if feature == Format(FORMAT_PE):
-            dnfile_extractor = DotnetFileFeatureExtractor(sample)
+            dnfile_extractor = DnfileFeatureExtractor(sample)
            if dnfile_extractor.is_dotnet_file():
                feature = Format(FORMAT_DOTNET)

@@ -147,29 +120,12 @@ def redirecting_print_to_tqdm(disable_progress):

 def log_unsupported_format_error():
    logger.error("-" * 80)
-    logger.error(" Input file does not appear to be a supported file.")
+    logger.error(" Input file does not appear to be a PE or ELF file.")
    logger.error(" ")
-    logger.error(" See all supported file formats via capa's help output (-h).")
-    logger.error(" If you don't know the input file type, you can try using the `file` utility to guess it.")
-    logger.error("-" * 80)
-
-
-def log_unsupported_cape_report_error(error: str):
-    logger.error("-" * 80)
-    logger.error("Input file is not a valid CAPE report: %s", error)
-    logger.error(" ")
-    logger.error(" capa currently only supports analyzing standard CAPE reports in JSON format.")
    logger.error(
-        " Please make sure your report file is in the standard format and contains both the static and dynamic sections."
+        " capa currently only supports analyzing PE and ELF files (or shellcode, when using --format sc32|sc64)."
    )
-    logger.error("-" * 80)
-
-
-def log_empty_cape_report_error(error: str):
-    logger.error("-" * 80)
-    logger.error(" CAPE report is empty or only contains little useful data: %s", error)
-    logger.error(" ")
-    logger.error(" Please make sure the sandbox run captures useful behaviour of your sample.")
+    logger.error(" If you don't know the input file type, you can try using the `file` utility to guess it.")
    logger.error("-" * 80)


--- a/capa/ida/helpers.py
+++ b/capa/ida/helpers.py
@@ -5,6 +5,7 @@
 # Unless required by applicable law or agreed to in writing, software distributed under the License
 #  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and limitations under the License.
+import json
 import logging
 import datetime
 import contextlib
@@ -152,15 +153,14 @@ def collect_metadata(rules: List[Path]):
            sha256=sha256,
            path=idaapi.get_input_file_path(),
        ),
-        flavor=rdoc.Flavor.STATIC,
-        analysis=rdoc.StaticAnalysis(
+        analysis=rdoc.Analysis(
            format=idaapi.get_file_type_name(),
            arch=arch,
            os=os,
            extractor="ida",
            rules=tuple(r.resolve().absolute().as_posix() for r in rules),
            base_address=capa.features.freeze.Address.from_capa(idaapi.get_imagebase()),
-            layout=rdoc.StaticLayout(
+            layout=rdoc.Layout(
                functions=(),
                # this is updated after capabilities have been collected.
                # will look like:
@@ -168,7 +168,7 @@ def collect_metadata(rules: List[Path]):
                # "functions": { 0x401000: { "matched_basic_blocks": [ 0x401000, 0x401005, ... ] }, ... }
            ),
            # ignore these for now - not used by IDA plugin.
-            feature_counts=rdoc.StaticFeatureCounts(file=0, functions=()),
+            feature_counts=rdoc.FeatureCounts(file=0, functions=()),
            library_functions=(),
        ),
    )
@@ -223,7 +223,7 @@ def load_and_verify_cached_results() -> Optional[rdoc.ResultDocument]:
    logger.debug("loading cached capa results from netnode '%s'", CAPA_NETNODE)

    n = netnode.Netnode(CAPA_NETNODE)
-    doc = rdoc.ResultDocument.model_validate_json(n[NETNODE_RESULTS])
+    doc = rdoc.ResultDocument.parse_obj(json.loads(n[NETNODE_RESULTS]))

    for rule in rutils.capability_rules(doc):
        for location_, _ in rule.matches:
--- a/capa/ida/plugin/form.py
+++ b/capa/ida/plugin/form.py
@@ -25,7 +25,6 @@ import capa.version
 import capa.ida.helpers
 import capa.render.json
 import capa.features.common
-import capa.capabilities.common
 import capa.render.result_document
 import capa.features.extractors.ida.extractor
 from capa.rules import Rule
@@ -574,11 +573,10 @@ class CapaExplorerForm(idaapi.PluginForm):

    def ensure_capa_settings_rule_path(self):
        try:
-            path: str = settings.user.get(CAPA_SETTINGS_RULE_PATH, "")
+            path: Path = Path(settings.user.get(CAPA_SETTINGS_RULE_PATH, ""))

            # resolve rules directory - check self and settings first, then ask user
-            # pathlib.Path considers "" equivalent to "." so we first check if rule path is an empty string
-            if not path or not Path(path).exists():
+            if not path.exists():
                # configure rules selection messagebox
                rules_message = QtWidgets.QMessageBox()
                rules_message.setIcon(QtWidgets.QMessageBox.Information)
@@ -596,15 +594,15 @@ class CapaExplorerForm(idaapi.PluginForm):
                if pressed == QtWidgets.QMessageBox.Cancel:
                    raise UserCancelledError()

-                path = self.ask_user_directory()
+                path = Path(self.ask_user_directory())
                if not path:
                    raise UserCancelledError()

-                if not Path(path).exists():
+                if not path.exists():
                    logger.error("rule path %s does not exist or cannot be accessed", path)
                    return False

-                settings.user[CAPA_SETTINGS_RULE_PATH] = path
+                settings.user[CAPA_SETTINGS_RULE_PATH] = str(path)
        except UserCancelledError:
            capa.ida.helpers.inform_user_ida_ui("Analysis requires capa rules")
            logger.warning(
@@ -769,7 +767,7 @@ class CapaExplorerForm(idaapi.PluginForm):

                try:
                    meta = capa.ida.helpers.collect_metadata([Path(settings.user[CAPA_SETTINGS_RULE_PATH])])
-                    capabilities, counts = capa.capabilities.common.find_capabilities(
+                    capabilities, counts = capa.main.find_capabilities(
                        ruleset, self.feature_extractor, disable_progress=True
                    )

@@ -811,7 +809,7 @@ class CapaExplorerForm(idaapi.PluginForm):

                        capa.ida.helpers.inform_user_ida_ui("capa encountered file type warnings during analysis")

-                    if capa.capabilities.common.has_file_limitation(ruleset, capabilities, is_standalone=False):
+                    if capa.main.has_file_limitation(ruleset, capabilities, is_standalone=False):
                        capa.ida.helpers.inform_user_ida_ui("capa encountered file limitation warnings during analysis")
                except Exception as e:
                    logger.exception("Failed to check for file limitations (error: %s)", e)
@@ -1193,13 +1191,10 @@ class CapaExplorerForm(idaapi.PluginForm):
            return

        is_match: bool = False
-        if self.rulegen_current_function is not None and any(
-            s in rule.scopes
-            for s in (
-                capa.rules.Scope.FUNCTION,
-                capa.rules.Scope.BASIC_BLOCK,
-                capa.rules.Scope.INSTRUCTION,
-            )
+        if self.rulegen_current_function is not None and rule.scope in (
+            capa.rules.Scope.FUNCTION,
+            capa.rules.Scope.BASIC_BLOCK,
+            capa.rules.Scope.INSTRUCTION,
        ):
            try:
                _, func_matches, bb_matches, insn_matches = self.rulegen_feature_cache.find_code_capabilities(
@@ -1209,13 +1204,13 @@ class CapaExplorerForm(idaapi.PluginForm):
                self.set_rulegen_status(f"Failed to create function rule matches from rule set ({e})")
                return

-            if capa.rules.Scope.FUNCTION in rule.scopes and rule.name in func_matches:
+            if rule.scope == capa.rules.Scope.FUNCTION and rule.name in func_matches:
                is_match = True
-            elif capa.rules.Scope.BASIC_BLOCK in rule.scopes and rule.name in bb_matches:
+            elif rule.scope == capa.rules.Scope.BASIC_BLOCK and rule.name in bb_matches:
                is_match = True
-            elif capa.rules.Scope.INSTRUCTION in rule.scopes and rule.name in insn_matches:
+            elif rule.scope == capa.rules.Scope.INSTRUCTION and rule.name in insn_matches:
                is_match = True
-        elif capa.rules.Scope.FILE in rule.scopes:
+        elif rule.scope == capa.rules.Scope.FILE:
            try:
                _, file_matches = self.rulegen_feature_cache.find_file_capabilities(ruleset)
            except Exception as e:
@@ -1309,7 +1304,7 @@ class CapaExplorerForm(idaapi.PluginForm):
            idaapi.info("No program analysis to save.")
            return

-        s = self.resdoc_cache.model_dump_json().encode("utf-8")
+        s = self.resdoc_cache.json().encode("utf-8")

        path = Path(self.ask_user_capa_json_file())
        if not path.exists():
--- a/capa/ida/plugin/model.py
+++ b/capa/ida/plugin/model.py
@@ -500,16 +500,16 @@ class CapaExplorerDataModel(QtCore.QAbstractItemModel):
                location = location_.to_capa()

                parent2: CapaExplorerDataItem
-                if capa.rules.Scope.FILE in rule.meta.scopes:
+                if rule.meta.scope == capa.rules.FILE_SCOPE:
                    parent2 = parent
-                elif capa.rules.Scope.FUNCTION in rule.meta.scopes:
+                elif rule.meta.scope == capa.rules.FUNCTION_SCOPE:
                    parent2 = CapaExplorerFunctionItem(parent, location)
-                elif capa.rules.Scope.BASIC_BLOCK in rule.meta.scopes:
+                elif rule.meta.scope == capa.rules.BASIC_BLOCK_SCOPE:
                    parent2 = CapaExplorerBlockItem(parent, location)
-                elif capa.rules.Scope.INSTRUCTION in rule.meta.scopes:
+                elif rule.meta.scope == capa.rules.INSTRUCTION_SCOPE:
                    parent2 = CapaExplorerInstructionItem(parent, location)
                else:
-                    raise RuntimeError("unexpected rule scope: " + str(rule.meta.scopes.static))
+                    raise RuntimeError("unexpected rule scope: " + str(rule.meta.scope))

                self.render_capa_doc_match(parent2, match, doc)

--- a/capa/main.py
+++ b/capa/main.py
@@ -11,21 +11,23 @@ See the License for the specific language governing permissions and limitations
 import io
 import os
 import sys
-import json
 import time
+import hashlib
 import logging
 import argparse
 import datetime
 import textwrap
+import itertools
 import contextlib
-from types import TracebackType
-from typing import Any, Set, Dict, List, Callable, Optional
+import collections
+from typing import Any, Dict, List, Tuple, Callable, Optional
 from pathlib import Path

 import halo
+import tqdm
 import colorama
+import tqdm.contrib.logging
 from pefile import PEFormatError
-from typing_extensions import assert_never
 from elftools.common.exceptions import ELFError

 import capa.perf
@@ -45,53 +47,38 @@ import capa.render.result_document
 import capa.render.result_document as rdoc
 import capa.features.extractors.common
 import capa.features.extractors.pefile
-import capa.features.extractors.dexfile
+import capa.features.extractors.dnfile_
 import capa.features.extractors.elffile
 import capa.features.extractors.dotnetfile
 import capa.features.extractors.base_extractor
-import capa.features.extractors.cape.extractor
-from capa.rules import Rule, RuleSet
-from capa.engine import MatchResults
+from capa.rules import Rule, Scope, RuleSet
+from capa.engine import FeatureSet, MatchResults
 from capa.helpers import (
+    get_format,
    get_file_taste,
    get_auto_format,
    log_unsupported_os_error,
+    redirecting_print_to_tqdm,
    log_unsupported_arch_error,
-    log_empty_cape_report_error,
    log_unsupported_format_error,
-    log_unsupported_cape_report_error,
-)
-from capa.exceptions import (
-    EmptyReportError,
-    UnsupportedOSError,
-    UnsupportedArchError,
-    UnsupportedFormatError,
-    UnsupportedRuntimeError,
 )
+from capa.exceptions import UnsupportedOSError, UnsupportedArchError, UnsupportedFormatError, UnsupportedRuntimeError
 from capa.features.common import (
    OS_AUTO,
    OS_LINUX,
    OS_MACOS,
    FORMAT_PE,
-    FORMAT_DEX,
    FORMAT_ELF,
    OS_WINDOWS,
    FORMAT_AUTO,
-    FORMAT_CAPE,
    FORMAT_SC32,
    FORMAT_SC64,
    FORMAT_DOTNET,
    FORMAT_FREEZE,
    FORMAT_RESULT,
 )
-from capa.features.address import Address
-from capa.capabilities.common import find_capabilities, has_file_limitation, find_file_capabilities
-from capa.features.extractors.base_extractor import (
-    SampleHashes,
-    FeatureExtractor,
-    StaticFeatureExtractor,
-    DynamicFeatureExtractor,
-)
+from capa.features.address import NO_ADDRESS, Address
+from capa.features.extractors.base_extractor import BBHandle, InsnHandle, FunctionHandle, FeatureExtractor

 RULES_PATH_DEFAULT_STRING = "(embedded rules)"
 SIGNATURES_PATH_DEFAULT_STRING = "(embedded signatures)"
@@ -110,10 +97,6 @@ E_INVALID_FILE_TYPE = 16
 E_INVALID_FILE_ARCH = 17
 E_INVALID_FILE_OS = 18
 E_UNSUPPORTED_IDA_VERSION = 19
-E_UNSUPPORTED_GHIDRA_VERSION = 20
-E_MISSING_CAPE_STATIC_ANALYSIS = 21
-E_MISSING_CAPE_DYNAMIC_ANALYSIS = 22
-E_EMPTY_REPORT = 23

 logger = logging.getLogger("capa")

@@ -136,6 +119,262 @@ def set_vivisect_log_level(level):
    logging.getLogger("Elf").setLevel(level)


+def find_instruction_capabilities(
+    ruleset: RuleSet, extractor: FeatureExtractor, f: FunctionHandle, bb: BBHandle, insn: InsnHandle
+) -> Tuple[FeatureSet, MatchResults]:
+    """
+    find matches for the given rules for the given instruction.
+
+    returns: tuple containing (features for instruction, match results for instruction)
+    """
+    # all features found for the instruction.
+    features = collections.defaultdict(set)  # type: FeatureSet
+
+    for feature, addr in itertools.chain(
+        extractor.extract_insn_features(f, bb, insn), extractor.extract_global_features()
+    ):
+        features[feature].add(addr)
+
+    # matches found at this instruction.
+    _, matches = ruleset.match(Scope.INSTRUCTION, features, insn.address)
+
+    for rule_name, res in matches.items():
+        rule = ruleset[rule_name]
+        for addr, _ in res:
+            capa.engine.index_rule_matches(features, rule, [addr])
+
+    return features, matches
+
+
+def find_basic_block_capabilities(
+    ruleset: RuleSet, extractor: FeatureExtractor, f: FunctionHandle, bb: BBHandle
+) -> Tuple[FeatureSet, MatchResults, MatchResults]:
+    """
+    find matches for the given rules within the given basic block.
+
+    returns: tuple containing (features for basic block, match results for basic block, match results for instructions)
+    """
+    # all features found within this basic block,
+    # includes features found within instructions.
+    features = collections.defaultdict(set)  # type: FeatureSet
+
+    # matches found at the instruction scope.
+    # might be found at different instructions, thats ok.
+    insn_matches = collections.defaultdict(list)  # type: MatchResults
+
+    for insn in extractor.get_instructions(f, bb):
+        ifeatures, imatches = find_instruction_capabilities(ruleset, extractor, f, bb, insn)
+        for feature, vas in ifeatures.items():
+            features[feature].update(vas)
+
+        for rule_name, res in imatches.items():
+            insn_matches[rule_name].extend(res)
+
+    for feature, va in itertools.chain(
+        extractor.extract_basic_block_features(f, bb), extractor.extract_global_features()
+    ):
+        features[feature].add(va)
+
+    # matches found within this basic block.
+    _, matches = ruleset.match(Scope.BASIC_BLOCK, features, bb.address)
+
+    for rule_name, res in matches.items():
+        rule = ruleset[rule_name]
+        for va, _ in res:
+            capa.engine.index_rule_matches(features, rule, [va])
+
+    return features, matches, insn_matches
+
+
+def find_code_capabilities(
+    ruleset: RuleSet, extractor: FeatureExtractor, fh: FunctionHandle
+) -> Tuple[MatchResults, MatchResults, MatchResults, int]:
+    """
+    find matches for the given rules within the given function.
+
+    returns: tuple containing (match results for function, match results for basic blocks, match results for instructions, number of features)
+    """
+    # all features found within this function,
+    # includes features found within basic blocks (and instructions).
+    function_features = collections.defaultdict(set)  # type: FeatureSet
+
+    # matches found at the basic block scope.
+    # might be found at different basic blocks, thats ok.
+    bb_matches = collections.defaultdict(list)  # type: MatchResults
+
+    # matches found at the instruction scope.
+    # might be found at different instructions, thats ok.
+    insn_matches = collections.defaultdict(list)  # type: MatchResults
+
+    for bb in extractor.get_basic_blocks(fh):
+        features, bmatches, imatches = find_basic_block_capabilities(ruleset, extractor, fh, bb)
+        for feature, vas in features.items():
+            function_features[feature].update(vas)
+
+        for rule_name, res in bmatches.items():
+            bb_matches[rule_name].extend(res)
+
+        for rule_name, res in imatches.items():
+            insn_matches[rule_name].extend(res)
+
+    for feature, va in itertools.chain(extractor.extract_function_features(fh), extractor.extract_global_features()):
+        function_features[feature].add(va)
+
+    _, function_matches = ruleset.match(Scope.FUNCTION, function_features, fh.address)
+    return function_matches, bb_matches, insn_matches, len(function_features)
+
+
+def find_file_capabilities(ruleset: RuleSet, extractor: FeatureExtractor, function_features: FeatureSet):
+    file_features = collections.defaultdict(set)  # type: FeatureSet
+
+    for feature, va in itertools.chain(extractor.extract_file_features(), extractor.extract_global_features()):
+        # not all file features may have virtual addresses.
+        # if not, then at least ensure the feature shows up in the index.
+        # the set of addresses will still be empty.
+        if va:
+            file_features[feature].add(va)
+        else:
+            if feature not in file_features:
+                file_features[feature] = set()
+
+    logger.debug("analyzed file and extracted %d features", len(file_features))
+
+    file_features.update(function_features)
+
+    _, matches = ruleset.match(Scope.FILE, file_features, NO_ADDRESS)
+    return matches, len(file_features)
+
+
+def find_capabilities(ruleset: RuleSet, extractor: FeatureExtractor, disable_progress=None) -> Tuple[MatchResults, Any]:
+    all_function_matches = collections.defaultdict(list)  # type: MatchResults
+    all_bb_matches = collections.defaultdict(list)  # type: MatchResults
+    all_insn_matches = collections.defaultdict(list)  # type: MatchResults
+
+    feature_counts = rdoc.FeatureCounts(file=0, functions=())
+    library_functions: Tuple[rdoc.LibraryFunction, ...] = ()
+
+    with redirecting_print_to_tqdm(disable_progress):
+        with tqdm.contrib.logging.logging_redirect_tqdm():
+            pbar = tqdm.tqdm
+            if disable_progress:
+                # do not use tqdm to avoid unnecessary side effects when caller intends
+                # to disable progress completely
+                def pbar(s, *args, **kwargs):
+                    return s
+
+            functions = list(extractor.get_functions())
+            n_funcs = len(functions)
+
+            pb = pbar(functions, desc="matching", unit=" functions", postfix="skipped 0 library functions", leave=False)
+            for f in pb:
+                t0 = time.time()
+                if extractor.is_library_function(f.address):
+                    function_name = extractor.get_function_name(f.address)
+                    logger.debug("skipping library function 0x%x (%s)", f.address, function_name)
+                    library_functions += (
+                        rdoc.LibraryFunction(address=frz.Address.from_capa(f.address), name=function_name),
+                    )
+                    n_libs = len(library_functions)
+                    percentage = round(100 * (n_libs / n_funcs))
+                    if isinstance(pb, tqdm.tqdm):
+                        pb.set_postfix_str(f"skipped {n_libs} library functions ({percentage}%)")
+                    continue
+
+                function_matches, bb_matches, insn_matches, feature_count = find_code_capabilities(
+                    ruleset, extractor, f
+                )
+                feature_counts.functions += (
+                    rdoc.FunctionFeatureCount(address=frz.Address.from_capa(f.address), count=feature_count),
+                )
+                t1 = time.time()
+
+                match_count = sum(len(res) for res in function_matches.values())
+                match_count += sum(len(res) for res in bb_matches.values())
+                match_count += sum(len(res) for res in insn_matches.values())
+                logger.debug(
+                    "analyzed function 0x%x and extracted %d features, %d matches in %0.02fs",
+                    f.address,
+                    feature_count,
+                    match_count,
+                    t1 - t0,
+                )
+
+                for rule_name, res in function_matches.items():
+                    all_function_matches[rule_name].extend(res)
+                for rule_name, res in bb_matches.items():
+                    all_bb_matches[rule_name].extend(res)
+                for rule_name, res in insn_matches.items():
+                    all_insn_matches[rule_name].extend(res)
+
+    # collection of features that captures the rule matches within function, BB, and instruction scopes.
+    # mapping from feature (matched rule) to set of addresses at which it matched.
+    function_and_lower_features: FeatureSet = collections.defaultdict(set)
+    for rule_name, results in itertools.chain(
+        all_function_matches.items(), all_bb_matches.items(), all_insn_matches.items()
+    ):
+        locations = {p[0] for p in results}
+        rule = ruleset[rule_name]
+        capa.engine.index_rule_matches(function_and_lower_features, rule, locations)
+
+    all_file_matches, feature_count = find_file_capabilities(ruleset, extractor, function_and_lower_features)
+    feature_counts.file = feature_count
+
+    matches = dict(
+        itertools.chain(
+            # each rule exists in exactly one scope,
+            # so there won't be any overlap among these following MatchResults,
+            # and we can merge the dictionaries naively.
+            all_insn_matches.items(),
+            all_bb_matches.items(),
+            all_function_matches.items(),
+            all_file_matches.items(),
+        )
+    )
+
+    meta = {
+        "feature_counts": feature_counts,
+        "library_functions": library_functions,
+    }
+
+    return matches, meta
+
+
+def has_rule_with_namespace(rules: RuleSet, capabilities: MatchResults, namespace: str) -> bool:
+    return any(
+        rules.rules[rule_name].meta.get("namespace", "").startswith(namespace) for rule_name in capabilities.keys()
+    )
+
+
+def is_internal_rule(rule: Rule) -> bool:
+    return rule.meta.get("namespace", "").startswith("internal/")
+
+
+def is_file_limitation_rule(rule: Rule) -> bool:
+    return rule.meta.get("namespace", "") == "internal/limitation/file"
+
+
+def has_file_limitation(rules: RuleSet, capabilities: MatchResults, is_standalone=True) -> bool:
+    file_limitation_rules = list(filter(is_file_limitation_rule, rules.rules.values()))
+
+    for file_limitation_rule in file_limitation_rules:
+        if file_limitation_rule.name not in capabilities:
+            continue
+
+        logger.warning("-" * 80)
+        for line in file_limitation_rule.meta.get("description", "").split("\n"):
+            logger.warning(" %s", line)
+        logger.warning(" Identified via rule: %s", file_limitation_rule.name)
+        if is_standalone:
+            logger.warning(" ")
+            logger.warning(" Use -v or -vv if you really want to see the capabilities identified by capa.")
+        logger.warning("-" * 80)
+
+        # bail on first file limitation
+        return True
+
+    return False
+
+
 def is_supported_format(sample: Path) -> bool:
    """
    Return if this is a supported file based on magic header values
@@ -287,8 +526,7 @@ def get_extractor(
      UnsupportedArchError
      UnsupportedOSError
    """
-
-    if format_ not in (FORMAT_SC32, FORMAT_SC64, FORMAT_CAPE):
+    if format_ not in (FORMAT_SC32, FORMAT_SC64):
        if not is_supported_format(path):
            raise UnsupportedFormatError()

@@ -298,22 +536,11 @@ def get_extractor(
        if os_ == OS_AUTO and not is_supported_os(path):
            raise UnsupportedOSError()

-    if format_ == FORMAT_CAPE:
-        import capa.features.extractors.cape.extractor
-
-        report = json.load(Path(path).open(encoding="utf-8"))
-        return capa.features.extractors.cape.extractor.CapeExtractor.from_report(report)
-
-    elif format_ == FORMAT_DOTNET:
+    if format_ == FORMAT_DOTNET:
        import capa.features.extractors.dnfile.extractor

        return capa.features.extractors.dnfile.extractor.DnfileFeatureExtractor(path)

-    elif format_ == FORMAT_DEX:
-        import capa.features.extractors.dexfile
-
-        return capa.features.extractors.dexfile.DexFeatureExtractor(path, code_analysis=True)
-
    elif backend == BACKEND_BINJA:
        from capa.features.extractors.binja.find_binja_api import find_binja_path

@@ -325,8 +552,7 @@ def get_extractor(
                sys.path.append(str(bn_api))

        try:
-            import binaryninja
-            from binaryninja import BinaryView
+            from binaryninja import BinaryView, BinaryViewType
        except ImportError:
            raise RuntimeError(
                "Cannot import binaryninja module. Please install the Binary Ninja Python API first: "
@@ -336,7 +562,7 @@ def get_extractor(
        import capa.features.extractors.binja.extractor

        with halo.Halo(text="analyzing program", spinner="simpleDots", stream=sys.stderr, enabled=not disable_progress):
-            bv: BinaryView = binaryninja.load(str(path))
+            bv: BinaryView = BinaryViewType.get_view_of_file(str(path))
            if bv is None:
                raise RuntimeError(f"Binary Ninja cannot open file {path}")

@@ -377,18 +603,11 @@ def get_file_extractors(sample: Path, format_: str) -> List[FeatureExtractor]:

    elif format_ == FORMAT_DOTNET:
        file_extractors.append(capa.features.extractors.pefile.PefileFeatureExtractor(sample))
-        file_extractors.append(capa.features.extractors.dotnetfile.DotnetFileFeatureExtractor(sample))
+        file_extractors.append(capa.features.extractors.dnfile_.DnfileFeatureExtractor(sample))

-    elif format_ == capa.features.common.FORMAT_ELF:
+    elif format_ == capa.features.extractors.common.FORMAT_ELF:
        file_extractors.append(capa.features.extractors.elffile.ElfFeatureExtractor(sample))

-    elif format_ == capa.features.common.FORMAT_DEX:
-        file_extractors.append(capa.features.extractors.dexfile.DexFeatureExtractor(sample, code_analysis=False))
-
-    elif format_ == FORMAT_CAPE:
-        report = json.load(Path(sample).open(encoding="utf-8"))
-        file_extractors.append(capa.features.extractors.cape.extractor.CapeExtractor.from_report(report))
-
    return file_extractors


@@ -470,7 +689,7 @@ def get_rules(
    if ruleset is not None:
        return ruleset

-    rules: List[Rule] = []
+    rules = []  # type: List[Rule]

    total_rule_count = len(rule_file_paths)
    for i, (path, content) in enumerate(zip(rule_file_paths, rule_contents)):
@@ -485,7 +704,7 @@ def get_rules(
            rule.meta["capa/nursery"] = is_nursery_rule_path(path)

            rules.append(rule)
-            logger.debug("loaded rule: '%s' with scope: %s", rule.name, rule.scopes)
+            logger.debug("loaded rule: '%s' with scope: %s", rule.name, rule.scope)

    ruleset = capa.rules.RuleSet(rules)

@@ -520,177 +739,60 @@ def get_signatures(sigs_path: Path) -> List[Path]:
    return paths


-def get_sample_analysis(format_, arch, os_, extractor, rules_path, counts):
-    if isinstance(extractor, StaticFeatureExtractor):
-        return rdoc.StaticAnalysis(
-            format=format_,
-            arch=arch,
-            os=os_,
-            extractor=extractor.__class__.__name__,
-            rules=tuple(rules_path),
-            base_address=frz.Address.from_capa(extractor.get_base_address()),
-            layout=rdoc.StaticLayout(
-                functions=(),
-                # this is updated after capabilities have been collected.
-                # will look like:
-                #
-                # "functions": { 0x401000: { "matched_basic_blocks": [ 0x401000, 0x401005, ... ] }, ... }
-            ),
-            feature_counts=counts["feature_counts"],
-            library_functions=counts["library_functions"],
-        )
-    elif isinstance(extractor, DynamicFeatureExtractor):
-        return rdoc.DynamicAnalysis(
-            format=format_,
-            arch=arch,
-            os=os_,
-            extractor=extractor.__class__.__name__,
-            rules=tuple(rules_path),
-            layout=rdoc.DynamicLayout(
-                processes=(),
-            ),
-            feature_counts=counts["feature_counts"],
-        )
-    else:
-        raise ValueError("invalid extractor type")
-
-
 def collect_metadata(
    argv: List[str],
    sample_path: Path,
    format_: str,
    os_: str,
    rules_path: List[Path],
-    extractor: FeatureExtractor,
-    counts: dict,
+    extractor: capa.features.extractors.base_extractor.FeatureExtractor,
 ) -> rdoc.Metadata:
-    # if it's a binary sample we hash it, if it's a report
-    # we fetch the hashes from the report
-    sample_hashes: SampleHashes = extractor.get_sample_hashes()
-    md5, sha1, sha256 = sample_hashes.md5, sample_hashes.sha1, sample_hashes.sha256
+    md5 = hashlib.md5()
+    sha1 = hashlib.sha1()
+    sha256 = hashlib.sha256()

-    global_feats = list(extractor.extract_global_features())
-    extractor_format = [f.value for (f, _) in global_feats if isinstance(f, capa.features.common.Format)]
-    extractor_arch = [f.value for (f, _) in global_feats if isinstance(f, capa.features.common.Arch)]
-    extractor_os = [f.value for (f, _) in global_feats if isinstance(f, capa.features.common.OS)]
+    buf = sample_path.read_bytes()

-    format_ = str(extractor_format[0]) if extractor_format else "unknown" if format_ == FORMAT_AUTO else format_
-    arch = str(extractor_arch[0]) if extractor_arch else "unknown"
-    os_ = str(extractor_os[0]) if extractor_os else "unknown" if os_ == OS_AUTO else os_
-
-    if isinstance(extractor, StaticFeatureExtractor):
-        meta_class: type = rdoc.StaticMetadata
-    elif isinstance(extractor, DynamicFeatureExtractor):
-        meta_class = rdoc.DynamicMetadata
-    else:
-        assert_never(extractor)
+    md5.update(buf)
+    sha1.update(buf)
+    sha256.update(buf)

    rules = tuple(r.resolve().absolute().as_posix() for r in rules_path)
+    format_ = get_format(sample_path) if format_ == FORMAT_AUTO else format_
+    arch = get_arch(sample_path)
+    os_ = get_os(sample_path) if os_ == OS_AUTO else os_

-    return meta_class(
+    return rdoc.Metadata(
        timestamp=datetime.datetime.now(),
        version=capa.version.__version__,
        argv=tuple(argv) if argv else None,
        sample=rdoc.Sample(
-            md5=md5,
-            sha1=sha1,
-            sha256=sha256,
-            path=Path(sample_path).resolve().as_posix(),
+            md5=md5.hexdigest(),
+            sha1=sha1.hexdigest(),
+            sha256=sha256.hexdigest(),
+            path=sample_path.resolve().absolute().as_posix(),
        ),
-        analysis=get_sample_analysis(
-            format_,
-            arch,
-            os_,
-            extractor,
-            rules,
-            counts,
+        analysis=rdoc.Analysis(
+            format=format_,
+            arch=arch,
+            os=os_,
+            extractor=extractor.__class__.__name__,
+            rules=rules,
+            base_address=frz.Address.from_capa(extractor.get_base_address()),
+            layout=rdoc.Layout(
+                functions=(),
+                # this is updated after capabilities have been collected.
+                # will look like:
+                #
+                # "functions": { 0x401000: { "matched_basic_blocks": [ 0x401000, 0x401005, ... ] }, ... }
+            ),
+            feature_counts=rdoc.FeatureCounts(file=0, functions=()),
+            library_functions=(),
        ),
    )


-def compute_dynamic_layout(rules, extractor: DynamicFeatureExtractor, capabilities: MatchResults) -> rdoc.DynamicLayout:
-    """
-    compute a metadata structure that links threads
-    to the processes in which they're found.
-
-    only collect the threads at which some rule matched.
-    otherwise, we may pollute the json document with
-    a large amount of un-referenced data.
-    """
-    assert isinstance(extractor, DynamicFeatureExtractor)
-
-    matched_calls: Set[Address] = set()
-
-    def result_rec(result: capa.features.common.Result):
-        for loc in result.locations:
-            if isinstance(loc, capa.features.address.DynamicCallAddress):
-                matched_calls.add(loc)
-        for child in result.children:
-            result_rec(child)
-
-    for matches in capabilities.values():
-        for _, result in matches:
-            result_rec(result)
-
-    names_by_process: Dict[Address, str] = {}
-    names_by_call: Dict[Address, str] = {}
-
-    matched_processes: Set[Address] = set()
-    matched_threads: Set[Address] = set()
-
-    threads_by_process: Dict[Address, List[Address]] = {}
-    calls_by_thread: Dict[Address, List[Address]] = {}
-
-    for p in extractor.get_processes():
-        threads_by_process[p.address] = []
-
-        for t in extractor.get_threads(p):
-            calls_by_thread[t.address] = []
-
-            for c in extractor.get_calls(p, t):
-                if c.address in matched_calls:
-                    names_by_call[c.address] = extractor.get_call_name(p, t, c)
-                    calls_by_thread[t.address].append(c.address)
-
-            if calls_by_thread[t.address]:
-                matched_threads.add(t.address)
-                threads_by_process[p.address].append(t.address)
-
-        if threads_by_process[p.address]:
-            matched_processes.add(p.address)
-            names_by_process[p.address] = extractor.get_process_name(p)
-
-    layout = rdoc.DynamicLayout(
-        processes=tuple(
-            rdoc.ProcessLayout(
-                address=frz.Address.from_capa(p),
-                name=names_by_process[p],
-                matched_threads=tuple(
-                    rdoc.ThreadLayout(
-                        address=frz.Address.from_capa(t),
-                        matched_calls=tuple(
-                            rdoc.CallLayout(
-                                address=frz.Address.from_capa(c),
-                                name=names_by_call[c],
-                            )
-                            for c in calls_by_thread[t]
-                            if c in matched_calls
-                        ),
-                    )
-                    for t in threads
-                    if t in matched_threads
-                )  # this object is open to extension in the future,
-                # such as with the function name, etc.
-            )
-            for p, threads in threads_by_process.items()
-            if p in matched_processes
-        )
-    )
-
-    return layout
-
-
-def compute_static_layout(rules, extractor: StaticFeatureExtractor, capabilities) -> rdoc.StaticLayout:
+def compute_layout(rules, extractor, capabilities) -> rdoc.Layout:
    """
    compute a metadata structure that links basic blocks
    to the functions in which they're found.
@@ -710,12 +812,12 @@ def compute_static_layout(rules, extractor: StaticFeatureExtractor, capabilities
    matched_bbs = set()
    for rule_name, matches in capabilities.items():
        rule = rules[rule_name]
-        if capa.rules.Scope.BASIC_BLOCK in rule.scopes:
+        if rule.meta.get("scope") == capa.rules.BASIC_BLOCK_SCOPE:
            for addr, _ in matches:
                assert addr in functions_by_bb
                matched_bbs.add(addr)

-    layout = rdoc.StaticLayout(
+    layout = rdoc.Layout(
        functions=tuple(
            rdoc.FunctionLayout(
                address=frz.Address.from_capa(f),
@@ -732,15 +834,6 @@ def compute_static_layout(rules, extractor: StaticFeatureExtractor, capabilities
    return layout


-def compute_layout(rules, extractor, capabilities) -> rdoc.Layout:
-    if isinstance(extractor, StaticFeatureExtractor):
-        return compute_static_layout(rules, extractor, capabilities)
-    elif isinstance(extractor, DynamicFeatureExtractor):
-        return compute_dynamic_layout(rules, extractor, capabilities)
-    else:
-        raise ValueError("extractor must be either a static or dynamic extracotr")
-
-
 def install_common_args(parser, wanted=None):
    """
    register a common set of command line arguments for re-use by main & scripts.
@@ -807,10 +900,8 @@ def install_common_args(parser, wanted=None):
            (FORMAT_PE, "Windows PE file"),
            (FORMAT_DOTNET, ".NET PE file"),
            (FORMAT_ELF, "Executable and Linkable Format"),
-            (FORMAT_DEX, "Android DEX file"),
            (FORMAT_SC32, "32-bit shellcode"),
            (FORMAT_SC64, "64-bit shellcode"),
-            (FORMAT_CAPE, "CAPE sandbox report"),
            (FORMAT_FREEZE, "features previously frozen by capa"),
        ]
        format_help = ", ".join([f"{f[0]}: {f[1]}" for f in formats])
@@ -989,27 +1080,6 @@ def handle_common_args(args):
        args.signatures = sigs_path


-def simple_message_exception_handler(exctype, value: BaseException, traceback: TracebackType):
-    """
-    prints friendly message on unexpected exceptions to regular users (debug mode shows regular stack trace)
-
-    args:
-      # TODO(aaronatp): Once capa drops support for Python 3.8, move the exctype type annotation to
-      # the function parameters and remove the "# type: ignore[assignment]" from the relevant place
-      # in the main function, see (https://github.com/mandiant/capa/issues/1896)
-      exctype (type[BaseException]): exception class
-    """
-
-    if exctype is KeyboardInterrupt:
-        print("KeyboardInterrupt detected, program terminated")
-    else:
-        print(
-            f"Unexpected exception raised: {exctype}. Please run capa in debug mode (-d/--debug) "
-            + "to see the stack trace. Please also report your issue on the capa GitHub page so we "
-            + "can improve the code! (https://github.com/mandiant/capa/issues)"
-        )
-
-
 def main(argv: Optional[List[str]] = None):
    if sys.version_info < (3, 8):
        raise UnsupportedRuntimeError("This version of capa can only be used with Python 3.8+")
@@ -1052,8 +1122,6 @@ def main(argv: Optional[List[str]] = None):
    install_common_args(parser, {"sample", "format", "backend", "os", "signatures", "rules", "tag"})
    parser.add_argument("-j", "--json", action="store_true", help="emit JSON instead of text")
    args = parser.parse_args(args=argv)
-    if not args.debug:
-        sys.excepthook = simple_message_exception_handler  # type: ignore[assignment]
    ret = handle_common_args(args)
    if ret is not None and ret != 0:
        return ret
@@ -1090,7 +1158,7 @@ def main(argv: Optional[List[str]] = None):
            # during the load of the RuleSet, we extract subscope statements into their own rules
            # that are subsequently `match`ed upon. this inflates the total rule count.
            # so, filter out the subscope rules when reporting total number of loaded rules.
-            len(list(filter(lambda r: not (r.is_subscope_rule()), rules.rules.values()))),
+            len(list(filter(lambda r: not r.is_subscope_rule(), rules.rules.values()))),
        )
        if args.tag:
            rules = rules.filter_rules_by_meta(args.tag)
@@ -1129,26 +1197,8 @@ def main(argv: Optional[List[str]] = None):
    except (ELFError, OverflowError) as e:
        logger.error("Input file '%s' is not a valid ELF file: %s", args.sample, str(e))
        return E_CORRUPT_FILE
-    except UnsupportedFormatError as e:
-        if format_ == FORMAT_CAPE:
-            log_unsupported_cape_report_error(str(e))
-        else:
-            log_unsupported_format_error()
-        return E_INVALID_FILE_TYPE
-    except EmptyReportError as e:
-        if format_ == FORMAT_CAPE:
-            log_empty_cape_report_error(str(e))
-            return E_EMPTY_REPORT
-        else:
-            log_unsupported_format_error()
-            return E_INVALID_FILE_TYPE

-    found_file_limitation = False
    for file_extractor in file_extractors:
-        if isinstance(file_extractor, DynamicFeatureExtractor):
-            # Dynamic feature extractors can handle packed samples
-            continue
-
        try:
            pure_file_capabilities, _ = find_file_capabilities(rules, file_extractor, {})
        except PEFormatError as e:
@@ -1160,8 +1210,7 @@ def main(argv: Optional[List[str]] = None):

        # file limitations that rely on non-file scope won't be detected here.
        # nor on FunctionName features, because pefile doesn't support this.
-        found_file_limitation = has_file_limitation(rules, pure_file_capabilities)
-        if found_file_limitation:
+        if has_file_limitation(rules, pure_file_capabilities):
            # bail if capa encountered file limitation e.g. a packed binary
            # do show the output in verbose mode, though.
            if not (args.verbose or args.vverbose or args.json):
@@ -1174,7 +1223,7 @@ def main(argv: Optional[List[str]] = None):

    if format_ == FORMAT_RESULT:
        # result document directly parses into meta, capabilities
-        result_doc = capa.render.result_document.ResultDocument.from_file(Path(args.sample))
+        result_doc = capa.render.result_document.ResultDocument.parse_file(args.sample)
        meta, capabilities = result_doc.to_capa()

    else:
@@ -1183,7 +1232,7 @@ def main(argv: Optional[List[str]] = None):

        if format_ == FORMAT_FREEZE:
            # freeze format deserializes directly into an extractor
-            extractor: FeatureExtractor = frz.load(Path(args.sample).read_bytes())
+            extractor = frz.load(Path(args.sample).read_bytes())
        else:
            # all other formats we must create an extractor,
            # such as viv, binary ninja, etc. workspaces
@@ -1201,9 +1250,6 @@ def main(argv: Optional[List[str]] = None):

            should_save_workspace = os.environ.get("CAPA_SAVE_WORKSPACE") not in ("0", "no", "NO", "n", None)

-            # TODO(mr-tz): this should be wrapped and refactored as it's tedious to update everywhere
-            #  see same code and show-features above examples
-            #  https://github.com/mandiant/capa/issues/1813
            try:
                extractor = get_extractor(
                    args.sample,
@@ -1214,11 +1260,8 @@ def main(argv: Optional[List[str]] = None):
                    should_save_workspace,
                    disable_progress=args.quiet or args.debug,
                )
-            except UnsupportedFormatError as e:
-                if format_ == FORMAT_CAPE:
-                    log_unsupported_cape_report_error(str(e))
-                else:
-                    log_unsupported_format_error()
+            except UnsupportedFormatError:
+                log_unsupported_format_error()
                return E_INVALID_FILE_TYPE
            except UnsupportedArchError:
                log_unsupported_arch_error()
@@ -1227,13 +1270,16 @@ def main(argv: Optional[List[str]] = None):
                log_unsupported_os_error()
                return E_INVALID_FILE_OS

+        meta = collect_metadata(argv, args.sample, args.format, args.os, args.rules, extractor)
+
        capabilities, counts = find_capabilities(rules, extractor, disable_progress=args.quiet)

-        meta = collect_metadata(argv, args.sample, args.format, args.os, args.rules, extractor, counts)
+        meta.analysis.feature_counts = counts["feature_counts"]
+        meta.analysis.library_functions = counts["library_functions"]
        meta.analysis.layout = compute_layout(rules, extractor, capabilities)

-        if isinstance(extractor, StaticFeatureExtractor) and found_file_limitation:
-            # bail if capa's static feature extractor encountered file limitation e.g. a packed binary
+        if has_file_limitation(rules, capabilities):
+            # bail if capa encountered file limitation e.g. a packed binary
            # do show the output in verbose mode, though.
            if not (args.verbose or args.vverbose or args.json):
                return E_FILE_LIMITATION
@@ -1292,47 +1338,8 @@ def ida_main():
    print(capa.render.default.render(meta, rules, capabilities))


-def ghidra_main():
-    import capa.rules
-    import capa.ghidra.helpers
-    import capa.render.default
-    import capa.features.extractors.ghidra.extractor
-
-    logging.basicConfig(level=logging.INFO)
-    logging.getLogger().setLevel(logging.INFO)
-
-    logger.debug("-" * 80)
-    logger.debug(" Using default embedded rules.")
-    logger.debug(" ")
-    logger.debug(" You can see the current default rule set here:")
-    logger.debug("     https://github.com/mandiant/capa-rules")
-    logger.debug("-" * 80)
-
-    rules_path = get_default_root() / "rules"
-    logger.debug("rule path: %s", rules_path)
-    rules = get_rules([rules_path])
-
-    meta = capa.ghidra.helpers.collect_metadata([rules_path])
-
-    capabilities, counts = find_capabilities(
-        rules,
-        capa.features.extractors.ghidra.extractor.GhidraFeatureExtractor(),
-        not capa.ghidra.helpers.is_running_headless(),
-    )
-
-    meta.analysis.feature_counts = counts["feature_counts"]
-    meta.analysis.library_functions = counts["library_functions"]
-
-    if has_file_limitation(rules, capabilities, is_standalone=False):
-        logger.info("capa encountered warnings during analysis")
-
-    print(capa.render.default.render(meta, rules, capabilities))
-
-
 if __name__ == "__main__":
    if capa.helpers.is_runtime_ida():
        ida_main()
-    elif capa.helpers.is_runtime_ghidra():
-        ghidra_main()
    else:
        sys.exit(main())
--- a/capa/render/default.py
+++ b/capa/render/default.py
@@ -33,7 +33,6 @@ def render_meta(doc: rd.ResultDocument, ostream: StringIO):
        (width("md5", 22), width(doc.meta.sample.md5, 82)),
        ("sha1", doc.meta.sample.sha1),
        ("sha256", doc.meta.sample.sha256),
-        ("analysis", doc.meta.flavor),
        ("os", doc.meta.analysis.os),
        ("format", doc.meta.analysis.format),
        ("arch", doc.meta.analysis.arch),
--- a/capa/render/json.py
+++ b/capa/render/json.py
@@ -11,4 +11,4 @@ from capa.engine import MatchResults


 def render(meta, rules: RuleSet, capabilities: MatchResults) -> str:
-    return rd.ResultDocument.from_capa(meta, rules, capabilities).model_dump_json(exclude_none=True)
+    return rd.ResultDocument.from_capa(meta, rules, capabilities).json(exclude_none=True)
--- a/capa/render/proto/init.py
+++ b/capa/render/proto/init.py
@@ -38,6 +38,16 @@ from capa.helpers import assert_never
 from capa.features.freeze import AddressType


+def dict_tuple_to_list_values(d: Dict) -> Dict:
+    o = {}
+    for k, v in d.items():
+        if isinstance(v, tuple):
+            o[k] = list(v)
+        else:
+            o[k] = v
+    return o
+
+
 def int_to_pb2(v: int) -> capa_pb2.Integer:
    if v < -2_147_483_648:
        raise ValueError(f"value underflow: {v}")
@@ -90,51 +100,6 @@ def addr_to_pb2(addr: frz.Address) -> capa_pb2.Address:
            token_offset=capa_pb2.Token_Offset(token=int_to_pb2(token), offset=offset),
        )

-    elif addr.type is AddressType.PROCESS:
-        assert isinstance(addr.value, tuple)
-        ppid, pid = addr.value
-        assert isinstance(ppid, int)
-        assert isinstance(pid, int)
-        return capa_pb2.Address(
-            type=capa_pb2.AddressType.ADDRESSTYPE_PROCESS,
-            ppid_pid=capa_pb2.Ppid_Pid(
-                ppid=int_to_pb2(ppid),
-                pid=int_to_pb2(pid),
-            ),
-        )
-
-    elif addr.type is AddressType.THREAD:
-        assert isinstance(addr.value, tuple)
-        ppid, pid, tid = addr.value
-        assert isinstance(ppid, int)
-        assert isinstance(pid, int)
-        assert isinstance(tid, int)
-        return capa_pb2.Address(
-            type=capa_pb2.AddressType.ADDRESSTYPE_THREAD,
-            ppid_pid_tid=capa_pb2.Ppid_Pid_Tid(
-                ppid=int_to_pb2(ppid),
-                pid=int_to_pb2(pid),
-                tid=int_to_pb2(tid),
-            ),
-        )
-
-    elif addr.type is AddressType.CALL:
-        assert isinstance(addr.value, tuple)
-        ppid, pid, tid, id_ = addr.value
-        assert isinstance(ppid, int)
-        assert isinstance(pid, int)
-        assert isinstance(tid, int)
-        assert isinstance(id_, int)
-        return capa_pb2.Address(
-            type=capa_pb2.AddressType.ADDRESSTYPE_CALL,
-            ppid_pid_tid_id=capa_pb2.Ppid_Pid_Tid_Id(
-                ppid=int_to_pb2(ppid),
-                pid=int_to_pb2(pid),
-                tid=int_to_pb2(tid),
-                id=int_to_pb2(id_),
-            ),
-        )
-
    elif addr.type is AddressType.NO_ADDRESS:
        # value == None, so only set type
        return capa_pb2.Address(type=capa_pb2.AddressType.ADDRESSTYPE_NO_ADDRESS)
@@ -152,127 +117,47 @@ def scope_to_pb2(scope: capa.rules.Scope) -> capa_pb2.Scope.ValueType:
        return capa_pb2.Scope.SCOPE_BASIC_BLOCK
    elif scope == capa.rules.Scope.INSTRUCTION:
        return capa_pb2.Scope.SCOPE_INSTRUCTION
-    elif scope == capa.rules.Scope.PROCESS:
-        return capa_pb2.Scope.SCOPE_PROCESS
-    elif scope == capa.rules.Scope.THREAD:
-        return capa_pb2.Scope.SCOPE_THREAD
-    elif scope == capa.rules.Scope.CALL:
-        return capa_pb2.Scope.SCOPE_CALL
    else:
        assert_never(scope)


-def scopes_to_pb2(scopes: capa.rules.Scopes) -> capa_pb2.Scopes:
-    doc = {}
-    if scopes.static:
-        doc["static"] = scope_to_pb2(scopes.static)
-    if scopes.dynamic:
-        doc["dynamic"] = scope_to_pb2(scopes.dynamic)
-
-    return google.protobuf.json_format.ParseDict(doc, capa_pb2.Scopes())
-
-
-def flavor_to_pb2(flavor: rd.Flavor) -> capa_pb2.Flavor.ValueType:
-    if flavor == rd.Flavor.STATIC:
-        return capa_pb2.Flavor.FLAVOR_STATIC
-    elif flavor == rd.Flavor.DYNAMIC:
-        return capa_pb2.Flavor.FLAVOR_DYNAMIC
-    else:
-        assert_never(flavor)
-
-
-def static_analysis_to_pb2(analysis: rd.StaticAnalysis) -> capa_pb2.StaticAnalysis:
-    return capa_pb2.StaticAnalysis(
-        format=analysis.format,
-        arch=analysis.arch,
-        os=analysis.os,
-        extractor=analysis.extractor,
-        rules=list(analysis.rules),
-        base_address=addr_to_pb2(analysis.base_address),
-        layout=capa_pb2.StaticLayout(
-            functions=[
-                capa_pb2.FunctionLayout(
-                    address=addr_to_pb2(f.address),
-                    matched_basic_blocks=[
-                        capa_pb2.BasicBlockLayout(address=addr_to_pb2(bb.address)) for bb in f.matched_basic_blocks
-                    ],
-                )
-                for f in analysis.layout.functions
-            ]
-        ),
-        feature_counts=capa_pb2.StaticFeatureCounts(
-            file=analysis.feature_counts.file,
-            functions=[
-                capa_pb2.FunctionFeatureCount(address=addr_to_pb2(f.address), count=f.count)
-                for f in analysis.feature_counts.functions
-            ],
-        ),
-        library_functions=[
-            capa_pb2.LibraryFunction(address=addr_to_pb2(lf.address), name=lf.name) for lf in analysis.library_functions
-        ],
-    )
-
-
-def dynamic_analysis_to_pb2(analysis: rd.DynamicAnalysis) -> capa_pb2.DynamicAnalysis:
-    return capa_pb2.DynamicAnalysis(
-        format=analysis.format,
-        arch=analysis.arch,
-        os=analysis.os,
-        extractor=analysis.extractor,
-        rules=list(analysis.rules),
-        layout=capa_pb2.DynamicLayout(
-            processes=[
-                capa_pb2.ProcessLayout(
-                    address=addr_to_pb2(p.address),
-                    name=p.name,
-                    matched_threads=[
-                        capa_pb2.ThreadLayout(
-                            address=addr_to_pb2(t.address),
-                            matched_calls=[
-                                capa_pb2.CallLayout(
-                                    address=addr_to_pb2(c.address),
-                                    name=c.name,
-                                )
-                                for c in t.matched_calls
-                            ],
-                        )
-                        for t in p.matched_threads
-                    ],
-                )
-                for p in analysis.layout.processes
-            ]
-        ),
-        feature_counts=capa_pb2.DynamicFeatureCounts(
-            file=analysis.feature_counts.file,
-            processes=[
-                capa_pb2.ProcessFeatureCount(address=addr_to_pb2(p.address), count=p.count)
-                for p in analysis.feature_counts.processes
-            ],
-        ),
-    )
-
-
 def metadata_to_pb2(meta: rd.Metadata) -> capa_pb2.Metadata:
-    if isinstance(meta.analysis, rd.StaticAnalysis):
-        return capa_pb2.Metadata(
-            timestamp=str(meta.timestamp),
-            version=meta.version,
-            argv=meta.argv,
-            sample=google.protobuf.json_format.ParseDict(meta.sample.model_dump(), capa_pb2.Sample()),
-            flavor=flavor_to_pb2(meta.flavor),
-            static_analysis=static_analysis_to_pb2(meta.analysis),
-        )
-    elif isinstance(meta.analysis, rd.DynamicAnalysis):
-        return capa_pb2.Metadata(
-            timestamp=str(meta.timestamp),
-            version=meta.version,
-            argv=meta.argv,
-            sample=google.protobuf.json_format.ParseDict(meta.sample.model_dump(), capa_pb2.Sample()),
-            flavor=flavor_to_pb2(meta.flavor),
-            dynamic_analysis=dynamic_analysis_to_pb2(meta.analysis),
-        )
-    else:
-        assert_never(meta.analysis)
+    return capa_pb2.Metadata(
+        timestamp=str(meta.timestamp),
+        version=meta.version,
+        argv=meta.argv,
+        sample=google.protobuf.json_format.ParseDict(meta.sample.dict(), capa_pb2.Sample()),
+        analysis=capa_pb2.Analysis(
+            format=meta.analysis.format,
+            arch=meta.analysis.arch,
+            os=meta.analysis.os,
+            extractor=meta.analysis.extractor,
+            rules=list(meta.analysis.rules),
+            base_address=addr_to_pb2(meta.analysis.base_address),
+            layout=capa_pb2.Layout(
+                functions=[
+                    capa_pb2.FunctionLayout(
+                        address=addr_to_pb2(f.address),
+                        matched_basic_blocks=[
+                            capa_pb2.BasicBlockLayout(address=addr_to_pb2(bb.address)) for bb in f.matched_basic_blocks
+                        ],
+                    )
+                    for f in meta.analysis.layout.functions
+                ]
+            ),
+            feature_counts=capa_pb2.FeatureCounts(
+                file=meta.analysis.feature_counts.file,
+                functions=[
+                    capa_pb2.FunctionFeatureCount(address=addr_to_pb2(f.address), count=f.count)
+                    for f in meta.analysis.feature_counts.functions
+                ],
+            ),
+            library_functions=[
+                capa_pb2.LibraryFunction(address=addr_to_pb2(lf.address), name=lf.name)
+                for lf in meta.analysis.library_functions
+            ],
+        ),
+    )


 def statement_to_pb2(statement: rd.Statement) -> capa_pb2.StatementNode:
@@ -505,51 +390,15 @@ def match_to_pb2(match: rd.Match) -> capa_pb2.Match:
        assert_never(match)


-def attack_to_pb2(attack: rd.AttackSpec) -> capa_pb2.AttackSpec:
-    return capa_pb2.AttackSpec(
-        parts=list(attack.parts),
-        tactic=attack.tactic,
-        technique=attack.technique,
-        subtechnique=attack.subtechnique,
-        id=attack.id,
-    )
-
-
-def mbc_to_pb2(mbc: rd.MBCSpec) -> capa_pb2.MBCSpec:
-    return capa_pb2.MBCSpec(
-        parts=list(mbc.parts),
-        objective=mbc.objective,
-        behavior=mbc.behavior,
-        method=mbc.method,
-        id=mbc.id,
-    )
-
-
-def maec_to_pb2(maec: rd.MaecMetadata) -> capa_pb2.MaecMetadata:
-    return capa_pb2.MaecMetadata(
-        analysis_conclusion=maec.analysis_conclusion or "",
-        analysis_conclusion_ov=maec.analysis_conclusion_ov or "",
-        malware_family=maec.malware_family or "",
-        malware_category=maec.malware_category or "",
-        malware_category_ov=maec.malware_category_ov or "",
-    )
-
-
 def rule_metadata_to_pb2(rule_metadata: rd.RuleMetadata) -> capa_pb2.RuleMetadata:
-    return capa_pb2.RuleMetadata(
-        name=rule_metadata.name,
-        namespace=rule_metadata.namespace or "",
-        authors=rule_metadata.authors,
-        attack=[attack_to_pb2(m) for m in rule_metadata.attack],
-        mbc=[mbc_to_pb2(m) for m in rule_metadata.mbc],
-        references=rule_metadata.references,
-        examples=rule_metadata.examples,
-        description=rule_metadata.description,
-        lib=rule_metadata.lib,
-        maec=maec_to_pb2(rule_metadata.maec),
-        is_subscope_rule=rule_metadata.is_subscope_rule,
-        scopes=scopes_to_pb2(rule_metadata.scopes),
-    )
+    # after manual type conversions to the RuleMetadata, we can rely on the protobuf json parser
+    # conversions include tuple -> list and rd.Enum -> proto.enum
+    meta = dict_tuple_to_list_values(rule_metadata.dict())
+    meta["scope"] = scope_to_pb2(meta["scope"])
+    meta["attack"] = list(map(dict_tuple_to_list_values, meta.get("attack", [])))
+    meta["mbc"] = list(map(dict_tuple_to_list_values, meta.get("mbc", [])))
+
+    return google.protobuf.json_format.ParseDict(meta, capa_pb2.RuleMetadata())


 def doc_to_pb2(doc: rd.ResultDocument) -> capa_pb2.ResultDocument:
@@ -610,24 +459,6 @@ def addr_from_pb2(addr: capa_pb2.Address) -> frz.Address:
        offset = addr.token_offset.offset
        return frz.Address(type=frz.AddressType.DN_TOKEN_OFFSET, value=(token, offset))

-    elif addr.type == capa_pb2.AddressType.ADDRESSTYPE_PROCESS:
-        ppid = int_from_pb2(addr.ppid_pid.ppid)
-        pid = int_from_pb2(addr.ppid_pid.pid)
-        return frz.Address(type=frz.AddressType.PROCESS, value=(ppid, pid))
-
-    elif addr.type == capa_pb2.AddressType.ADDRESSTYPE_THREAD:
-        ppid = int_from_pb2(addr.ppid_pid_tid.ppid)
-        pid = int_from_pb2(addr.ppid_pid_tid.pid)
-        tid = int_from_pb2(addr.ppid_pid_tid.tid)
-        return frz.Address(type=frz.AddressType.THREAD, value=(ppid, pid, tid))
-
-    elif addr.type == capa_pb2.AddressType.ADDRESSTYPE_CALL:
-        ppid = int_from_pb2(addr.ppid_pid_tid_id.ppid)
-        pid = int_from_pb2(addr.ppid_pid_tid_id.pid)
-        tid = int_from_pb2(addr.ppid_pid_tid_id.tid)
-        id_ = int_from_pb2(addr.ppid_pid_tid_id.id)
-        return frz.Address(type=frz.AddressType.CALL, value=(ppid, pid, tid, id_))
-
    elif addr.type == capa_pb2.AddressType.ADDRESSTYPE_NO_ADDRESS:
        return frz.Address(type=frz.AddressType.NO_ADDRESS, value=None)

@@ -644,144 +475,61 @@ def scope_from_pb2(scope: capa_pb2.Scope.ValueType) -> capa.rules.Scope:
        return capa.rules.Scope.BASIC_BLOCK
    elif scope == capa_pb2.Scope.SCOPE_INSTRUCTION:
        return capa.rules.Scope.INSTRUCTION
-    elif scope == capa_pb2.Scope.SCOPE_PROCESS:
-        return capa.rules.Scope.PROCESS
-    elif scope == capa_pb2.Scope.SCOPE_THREAD:
-        return capa.rules.Scope.THREAD
-    elif scope == capa_pb2.Scope.SCOPE_CALL:
-        return capa.rules.Scope.CALL
    else:
        assert_never(scope)


-def scopes_from_pb2(scopes: capa_pb2.Scopes) -> capa.rules.Scopes:
-    return capa.rules.Scopes(
-        static=scope_from_pb2(scopes.static) if scopes.static else None,
-        dynamic=scope_from_pb2(scopes.dynamic) if scopes.dynamic else None,
-    )
-
-
-def flavor_from_pb2(flavor: capa_pb2.Flavor.ValueType) -> rd.Flavor:
-    if flavor == capa_pb2.Flavor.FLAVOR_STATIC:
-        return rd.Flavor.STATIC
-    elif flavor == capa_pb2.Flavor.FLAVOR_DYNAMIC:
-        return rd.Flavor.DYNAMIC
-    else:
-        assert_never(flavor)
-
-
-def static_analysis_from_pb2(analysis: capa_pb2.StaticAnalysis) -> rd.StaticAnalysis:
-    return rd.StaticAnalysis(
-        format=analysis.format,
-        arch=analysis.arch,
-        os=analysis.os,
-        extractor=analysis.extractor,
-        rules=tuple(analysis.rules),
-        base_address=addr_from_pb2(analysis.base_address),
-        layout=rd.StaticLayout(
-            functions=tuple(
-                [
-                    rd.FunctionLayout(
-                        address=addr_from_pb2(f.address),
-                        matched_basic_blocks=tuple(
-                            [rd.BasicBlockLayout(address=addr_from_pb2(bb.address)) for bb in f.matched_basic_blocks]
-                        ),
-                    )
-                    for f in analysis.layout.functions
-                ]
-            )
-        ),
-        feature_counts=rd.StaticFeatureCounts(
-            file=analysis.feature_counts.file,
-            functions=tuple(
-                [
-                    rd.FunctionFeatureCount(address=addr_from_pb2(f.address), count=f.count)
-                    for f in analysis.feature_counts.functions
-                ]
-            ),
-        ),
-        library_functions=tuple(
-            [rd.LibraryFunction(address=addr_from_pb2(lf.address), name=lf.name) for lf in analysis.library_functions]
-        ),
-    )
-
-
-def dynamic_analysis_from_pb2(analysis: capa_pb2.DynamicAnalysis) -> rd.DynamicAnalysis:
-    return rd.DynamicAnalysis(
-        format=analysis.format,
-        arch=analysis.arch,
-        os=analysis.os,
-        extractor=analysis.extractor,
-        rules=tuple(analysis.rules),
-        layout=rd.DynamicLayout(
-            processes=tuple(
-                [
-                    rd.ProcessLayout(
-                        address=addr_from_pb2(p.address),
-                        name=p.name,
-                        matched_threads=tuple(
-                            [
-                                rd.ThreadLayout(
-                                    address=addr_from_pb2(t.address),
-                                    matched_calls=tuple(
-                                        [
-                                            rd.CallLayout(address=addr_from_pb2(c.address), name=c.name)
-                                            for c in t.matched_calls
-                                        ]
-                                    ),
-                                )
-                                for t in p.matched_threads
-                            ]
-                        ),
-                    )
-                    for p in analysis.layout.processes
-                ]
-            )
-        ),
-        feature_counts=rd.DynamicFeatureCounts(
-            file=analysis.feature_counts.file,
-            processes=tuple(
-                [
-                    rd.ProcessFeatureCount(address=addr_from_pb2(p.address), count=p.count)
-                    for p in analysis.feature_counts.processes
-                ]
-            ),
-        ),
-    )
-
-
 def metadata_from_pb2(meta: capa_pb2.Metadata) -> rd.Metadata:
-    analysis_type = meta.WhichOneof("analysis2")
-    if analysis_type == "static_analysis":
-        return rd.Metadata(
-            timestamp=datetime.datetime.fromisoformat(meta.timestamp),
-            version=meta.version,
-            argv=tuple(meta.argv) if meta.argv else None,
-            sample=rd.Sample(
-                md5=meta.sample.md5,
-                sha1=meta.sample.sha1,
-                sha256=meta.sample.sha256,
-                path=meta.sample.path,
+    return rd.Metadata(
+        timestamp=datetime.datetime.fromisoformat(meta.timestamp),
+        version=meta.version,
+        argv=tuple(meta.argv) if meta.argv else None,
+        sample=rd.Sample(
+            md5=meta.sample.md5,
+            sha1=meta.sample.sha1,
+            sha256=meta.sample.sha256,
+            path=meta.sample.path,
+        ),
+        analysis=rd.Analysis(
+            format=meta.analysis.format,
+            arch=meta.analysis.arch,
+            os=meta.analysis.os,
+            extractor=meta.analysis.extractor,
+            rules=tuple(meta.analysis.rules),
+            base_address=addr_from_pb2(meta.analysis.base_address),
+            layout=rd.Layout(
+                functions=tuple(
+                    [
+                        rd.FunctionLayout(
+                            address=addr_from_pb2(f.address),
+                            matched_basic_blocks=tuple(
+                                [
+                                    rd.BasicBlockLayout(address=addr_from_pb2(bb.address))
+                                    for bb in f.matched_basic_blocks
+                                ]
+                            ),
+                        )
+                        for f in meta.analysis.layout.functions
+                    ]
+                )
            ),
-            flavor=flavor_from_pb2(meta.flavor),
-            analysis=static_analysis_from_pb2(meta.static_analysis),
-        )
-    elif analysis_type == "dynamic_analysis":
-        return rd.Metadata(
-            timestamp=datetime.datetime.fromisoformat(meta.timestamp),
-            version=meta.version,
-            argv=tuple(meta.argv) if meta.argv else None,
-            sample=rd.Sample(
-                md5=meta.sample.md5,
-                sha1=meta.sample.sha1,
-                sha256=meta.sample.sha256,
-                path=meta.sample.path,
+            feature_counts=rd.FeatureCounts(
+                file=meta.analysis.feature_counts.file,
+                functions=tuple(
+                    [
+                        rd.FunctionFeatureCount(address=addr_from_pb2(f.address), count=f.count)
+                        for f in meta.analysis.feature_counts.functions
+                    ]
+                ),
            ),
-            flavor=flavor_from_pb2(meta.flavor),
-            analysis=dynamic_analysis_from_pb2(meta.dynamic_analysis),
-        )
-    else:
-        assert_never(analysis_type)
+            library_functions=tuple(
+                [
+                    rd.LibraryFunction(address=addr_from_pb2(lf.address), name=lf.name)
+                    for lf in meta.analysis.library_functions
+                ]
+            ),
+        ),
+    )


 def statement_from_pb2(statement: capa_pb2.StatementNode) -> rd.Statement:
@@ -963,7 +711,7 @@ def rule_metadata_from_pb2(pb: capa_pb2.RuleMetadata) -> rd.RuleMetadata:
        name=pb.name,
        namespace=pb.namespace or None,
        authors=tuple(pb.authors),
-        scopes=scopes_from_pb2(pb.scopes),
+        scope=scope_from_pb2(pb.scope),
        attack=tuple([attack_from_pb2(attack) for attack in pb.attack]),
        mbc=tuple([mbc_from_pb2(mbc) for mbc in pb.mbc]),
        references=tuple(pb.references),
--- a/capa/render/proto/capa.proto
+++ b/capa/render/proto/capa.proto
@@ -11,9 +11,6 @@ message Address {
  oneof value {
    Integer v = 2;
    Token_Offset token_offset = 3;
-    Ppid_Pid ppid_pid = 4;
-    Ppid_Pid_Tid ppid_pid_tid = 5;
-    Ppid_Pid_Tid_Id ppid_pid_tid_id = 6;
  };
 }

@@ -25,9 +22,6 @@ enum AddressType {
  ADDRESSTYPE_DN_TOKEN = 4;
  ADDRESSTYPE_DN_TOKEN_OFFSET = 5;
  ADDRESSTYPE_NO_ADDRESS = 6;
-  ADDRESSTYPE_PROCESS = 7;
-  ADDRESSTYPE_THREAD = 8;
-  ADDRESSTYPE_CALL = 9;
 }

 message Analysis {
@@ -88,25 +82,6 @@ message CompoundStatement {
  optional string description = 2;
 }

-message DynamicAnalysis {
-  string format = 1;
-  string arch = 2;
-  string os = 3;
-  string extractor = 4;
-  repeated string rules = 5;
-  DynamicLayout layout = 6;
-  DynamicFeatureCounts feature_counts = 7;
-}
-
-message DynamicFeatureCounts {
-  uint64 file = 1;
-  repeated ProcessFeatureCount processes = 2;
-}
-
-message DynamicLayout {
-  repeated ProcessLayout processes = 1;
-}
-
 message ExportFeature {
  string type = 1;
  string export = 2;
@@ -217,26 +192,12 @@ message MatchFeature {
  optional string description = 3;
 }

-enum Flavor {
-  FLAVOR_UNSPECIFIED = 0;
-  FLAVOR_STATIC = 1;
-  FLAVOR_DYNAMIC = 2;
-}
-
 message Metadata {
  string timestamp = 1;  // iso8601 format, like: 2019-01-01T00:00:00Z 
  string version = 2;
  repeated string argv = 3;
  Sample sample = 4;
-  // deprecated in v7.0.
-  // use analysis2 instead.
-  Analysis analysis = 5 [deprecated = true];
-  Flavor flavor = 6;
-  oneof analysis2 {
-    // use analysis2 instead of analysis (deprecated in v7.0).
-    StaticAnalysis static_analysis = 7;
-    DynamicAnalysis dynamic_analysis = 8;
-  };
+  Analysis analysis = 5;
 }

 message MnemonicFeature {
@@ -283,17 +244,6 @@ message OperandOffsetFeature {
  optional string description = 4;
 }

-message ProcessFeatureCount {
-  Address address = 1;
-  uint64 count = 2;
-}
-
-message ProcessLayout {
-  Address address = 1;
-  repeated ThreadLayout matched_threads = 2;
-  string name = 3;
-}
-
 message PropertyFeature {
  string type = 1;
  string property_ = 2;  // property is a Python top-level decorator name
@@ -331,9 +281,7 @@ message RuleMetadata {
  string name = 1;
  string namespace = 2;
  repeated string authors = 3;
-  // deprecated in v7.0.
-  // use scopes instead.
-  Scope scope = 4 [deprecated = true];
+  Scope scope = 4;
  repeated AttackSpec attack = 5;
  repeated MBCSpec mbc = 6;
  repeated string references = 7;
@@ -342,8 +290,6 @@ message RuleMetadata {
  bool lib = 10;
  MaecMetadata maec = 11;
  bool is_subscope_rule = 12;
-  // use scopes over scope (deprecated in v7.0).
-  Scopes scopes = 13;
 }

 message Sample {
@@ -359,14 +305,6 @@ enum Scope {
  SCOPE_FUNCTION = 2;
  SCOPE_BASIC_BLOCK = 3;
  SCOPE_INSTRUCTION = 4;
-  SCOPE_PROCESS = 5;
-  SCOPE_THREAD = 6;
-  SCOPE_CALL = 7;
-}
-
-message Scopes {
-  optional Scope static = 1;
-  optional Scope dynamic = 2;
 }

 message SectionFeature {
@@ -391,27 +329,6 @@ message StatementNode {
  };
 }

-message StaticAnalysis {
-  string format = 1;
-  string arch = 2;
-  string os = 3;
-  string extractor = 4;
-  repeated string rules = 5;
-  Address base_address = 6;
-  StaticLayout layout = 7;
-  StaticFeatureCounts feature_counts = 8;
-  repeated LibraryFunction library_functions = 9;
-}
-
-message StaticFeatureCounts {
-  uint64 file = 1;
-  repeated FunctionFeatureCount functions = 2;
-}
-
-message StaticLayout {
-  repeated FunctionLayout functions = 1;
-}
-
 message StringFeature {
  string type = 1;
  string string = 2;
@@ -430,16 +347,6 @@ message SubstringFeature {
  optional string description = 3;
 }

-message CallLayout {
-  Address address = 1;
-  string name = 2;
-}
-
-message ThreadLayout {
-  Address address = 1;
-  repeated CallLayout matched_calls = 2;
-}
-
 message Addresses { repeated Address address = 1; }

 message Pair_Address_Match {
@@ -452,24 +359,6 @@ message Token_Offset {
  uint64 offset = 2;  // offset is always >= 0
 }

-message Ppid_Pid {
-  Integer ppid = 1;
-  Integer pid = 2;
-}
-
-message Ppid_Pid_Tid {
-  Integer ppid = 1;
-  Integer pid = 2;
-  Integer tid = 3;
-}
-
-message Ppid_Pid_Tid_Id {
-  Integer ppid = 1;
-  Integer pid = 2;
-  Integer tid = 3;
-  Integer id = 4;
-}
-
 message Integer { oneof value { uint64 u = 1; sint64 i = 2; } }  // unsigned or signed int

 message Number { oneof value { uint64 u = 1; sint64 i = 2; double f = 3; } }
--- a/capa/render/proto/capa_pb2.py
+++ b/capa/render/proto/capa_pb2.py
--- a/capa/render/proto/capa_pb2.pyi
+++ b/capa/render/proto/capa_pb2.pyi
@@ -31,9 +31,6 @@ class _AddressTypeEnumTypeWrapper(google.protobuf.internal.enum_type_wrapper._En
    ADDRESSTYPE_DN_TOKEN: _AddressType.ValueType  # 4
    ADDRESSTYPE_DN_TOKEN_OFFSET: _AddressType.ValueType  # 5
    ADDRESSTYPE_NO_ADDRESS: _AddressType.ValueType  # 6
-    ADDRESSTYPE_PROCESS: _AddressType.ValueType  # 7
-    ADDRESSTYPE_THREAD: _AddressType.ValueType  # 8
-    ADDRESSTYPE_CALL: _AddressType.ValueType  # 9

 class AddressType(_AddressType, metaclass=_AddressTypeEnumTypeWrapper): ...

@@ -44,28 +41,8 @@ ADDRESSTYPE_FILE: AddressType.ValueType  # 3
 ADDRESSTYPE_DN_TOKEN: AddressType.ValueType  # 4
 ADDRESSTYPE_DN_TOKEN_OFFSET: AddressType.ValueType  # 5
 ADDRESSTYPE_NO_ADDRESS: AddressType.ValueType  # 6
-ADDRESSTYPE_PROCESS: AddressType.ValueType  # 7
-ADDRESSTYPE_THREAD: AddressType.ValueType  # 8
-ADDRESSTYPE_CALL: AddressType.ValueType  # 9
 global___AddressType = AddressType

-class _Flavor:
-    ValueType = typing.NewType("ValueType", builtins.int)
-    V: typing_extensions.TypeAlias = ValueType
-
-class _FlavorEnumTypeWrapper(google.protobuf.internal.enum_type_wrapper._EnumTypeWrapper[_Flavor.ValueType], builtins.type):
-    DESCRIPTOR: google.protobuf.descriptor.EnumDescriptor
-    FLAVOR_UNSPECIFIED: _Flavor.ValueType  # 0
-    FLAVOR_STATIC: _Flavor.ValueType  # 1
-    FLAVOR_DYNAMIC: _Flavor.ValueType  # 2
-
-class Flavor(_Flavor, metaclass=_FlavorEnumTypeWrapper): ...
-
-FLAVOR_UNSPECIFIED: Flavor.ValueType  # 0
-FLAVOR_STATIC: Flavor.ValueType  # 1
-FLAVOR_DYNAMIC: Flavor.ValueType  # 2
-global___Flavor = Flavor
-
 class _Scope:
    ValueType = typing.NewType("ValueType", builtins.int)
    V: typing_extensions.TypeAlias = ValueType
@@ -77,9 +54,6 @@ class _ScopeEnumTypeWrapper(google.protobuf.internal.enum_type_wrapper._EnumType
    SCOPE_FUNCTION: _Scope.ValueType  # 2
    SCOPE_BASIC_BLOCK: _Scope.ValueType  # 3
    SCOPE_INSTRUCTION: _Scope.ValueType  # 4
-    SCOPE_PROCESS: _Scope.ValueType  # 5
-    SCOPE_THREAD: _Scope.ValueType  # 6
-    SCOPE_CALL: _Scope.ValueType  # 7

 class Scope(_Scope, metaclass=_ScopeEnumTypeWrapper): ...

@@ -88,9 +62,6 @@ SCOPE_FILE: Scope.ValueType  # 1
 SCOPE_FUNCTION: Scope.ValueType  # 2
 SCOPE_BASIC_BLOCK: Scope.ValueType  # 3
 SCOPE_INSTRUCTION: Scope.ValueType  # 4
-SCOPE_PROCESS: Scope.ValueType  # 5
-SCOPE_THREAD: Scope.ValueType  # 6
-SCOPE_CALL: Scope.ValueType  # 7
 global___Scope = Scope

@typing_extensions.final
@@ -123,33 +94,21 @@ class Address(google.protobuf.message.Message):
    TYPE_FIELD_NUMBER: builtins.int
    V_FIELD_NUMBER: builtins.int
    TOKEN_OFFSET_FIELD_NUMBER: builtins.int
-    PPID_PID_FIELD_NUMBER: builtins.int
-    PPID_PID_TID_FIELD_NUMBER: builtins.int
-    PPID_PID_TID_ID_FIELD_NUMBER: builtins.int
    type: global___AddressType.ValueType
    @property
    def v(self) -> global___Integer: ...
    @property
    def token_offset(self) -> global___Token_Offset: ...
-    @property
-    def ppid_pid(self) -> global___Ppid_Pid: ...
-    @property
-    def ppid_pid_tid(self) -> global___Ppid_Pid_Tid: ...
-    @property
-    def ppid_pid_tid_id(self) -> global___Ppid_Pid_Tid_Id: ...
    def __init__(
        self,
        *,
        type: global___AddressType.ValueType = ...,
        v: global___Integer | None = ...,
        token_offset: global___Token_Offset | None = ...,
-        ppid_pid: global___Ppid_Pid | None = ...,
-        ppid_pid_tid: global___Ppid_Pid_Tid | None = ...,
-        ppid_pid_tid_id: global___Ppid_Pid_Tid_Id | None = ...,
    ) -> None: ...
-    def HasField(self, field_name: typing_extensions.Literal["ppid_pid", b"ppid_pid", "ppid_pid_tid", b"ppid_pid_tid", "ppid_pid_tid_id", b"ppid_pid_tid_id", "token_offset", b"token_offset", "v", b"v", "value", b"value"]) -> builtins.bool: ...
-    def ClearField(self, field_name: typing_extensions.Literal["ppid_pid", b"ppid_pid", "ppid_pid_tid", b"ppid_pid_tid", "ppid_pid_tid_id", b"ppid_pid_tid_id", "token_offset", b"token_offset", "type", b"type", "v", b"v", "value", b"value"]) -> None: ...
-    def WhichOneof(self, oneof_group: typing_extensions.Literal["value", b"value"]) -> typing_extensions.Literal["v", "token_offset", "ppid_pid", "ppid_pid_tid", "ppid_pid_tid_id"] | None: ...
+    def HasField(self, field_name: typing_extensions.Literal["token_offset", b"token_offset", "v", b"v", "value", b"value"]) -> builtins.bool: ...
+    def ClearField(self, field_name: typing_extensions.Literal["token_offset", b"token_offset", "type", b"type", "v", b"v", "value", b"value"]) -> None: ...
+    def WhichOneof(self, oneof_group: typing_extensions.Literal["value", b"value"]) -> typing_extensions.Literal["v", "token_offset"] | None: ...

 global___Address = Address

@@ -376,78 +335,6 @@ class CompoundStatement(google.protobuf.message.Message):

 global___CompoundStatement = CompoundStatement

-@typing_extensions.final
-class DynamicAnalysis(google.protobuf.message.Message):
-    DESCRIPTOR: google.protobuf.descriptor.Descriptor
-
-    FORMAT_FIELD_NUMBER: builtins.int
-    ARCH_FIELD_NUMBER: builtins.int
-    OS_FIELD_NUMBER: builtins.int
-    EXTRACTOR_FIELD_NUMBER: builtins.int
-    RULES_FIELD_NUMBER: builtins.int
-    LAYOUT_FIELD_NUMBER: builtins.int
-    FEATURE_COUNTS_FIELD_NUMBER: builtins.int
-    format: builtins.str
-    arch: builtins.str
-    os: builtins.str
-    extractor: builtins.str
-    @property
-    def rules(self) -> google.protobuf.internal.containers.RepeatedScalarFieldContainer[builtins.str]: ...
-    @property
-    def layout(self) -> global___DynamicLayout: ...
-    @property
-    def feature_counts(self) -> global___DynamicFeatureCounts: ...
-    def __init__(
-        self,
-        *,
-        format: builtins.str = ...,
-        arch: builtins.str = ...,
-        os: builtins.str = ...,
-        extractor: builtins.str = ...,
-        rules: collections.abc.Iterable[builtins.str] | None = ...,
-        layout: global___DynamicLayout | None = ...,
-        feature_counts: global___DynamicFeatureCounts | None = ...,
-    ) -> None: ...
-    def HasField(self, field_name: typing_extensions.Literal["feature_counts", b"feature_counts", "layout", b"layout"]) -> builtins.bool: ...
-    def ClearField(self, field_name: typing_extensions.Literal["arch", b"arch", "extractor", b"extractor", "feature_counts", b"feature_counts", "format", b"format", "layout", b"layout", "os", b"os", "rules", b"rules"]) -> None: ...
-
-global___DynamicAnalysis = DynamicAnalysis
-
-@typing_extensions.final
-class DynamicFeatureCounts(google.protobuf.message.Message):
-    DESCRIPTOR: google.protobuf.descriptor.Descriptor
-
-    FILE_FIELD_NUMBER: builtins.int
-    PROCESSES_FIELD_NUMBER: builtins.int
-    file: builtins.int
-    @property
-    def processes(self) -> google.protobuf.internal.containers.RepeatedCompositeFieldContainer[global___ProcessFeatureCount]: ...
-    def __init__(
-        self,
-        *,
-        file: builtins.int = ...,
-        processes: collections.abc.Iterable[global___ProcessFeatureCount] | None = ...,
-    ) -> None: ...
-    def ClearField(self, field_name: typing_extensions.Literal["file", b"file", "processes", b"processes"]) -> None: ...
-
-global___DynamicFeatureCounts = DynamicFeatureCounts
-
-@typing_extensions.final
-class DynamicLayout(google.protobuf.message.Message):
-    DESCRIPTOR: google.protobuf.descriptor.Descriptor
-
-    PROCESSES_FIELD_NUMBER: builtins.int
-    @property
-    def processes(self) -> google.protobuf.internal.containers.RepeatedCompositeFieldContainer[global___ProcessLayout]: ...
-    def __init__(
-        self,
-        *,
-        processes: collections.abc.Iterable[global___ProcessLayout] | None = ...,
-    ) -> None: ...
-    def ClearField(self, field_name: typing_extensions.Literal["processes", b"processes"]) -> None: ...
-
-global___DynamicLayout = DynamicLayout
-
@typing_extensions.final
 class ExportFeature(google.protobuf.message.Message):
    DESCRIPTOR: google.protobuf.descriptor.Descriptor
@@ -889,9 +776,6 @@ class Metadata(google.protobuf.message.Message):
    ARGV_FIELD_NUMBER: builtins.int
    SAMPLE_FIELD_NUMBER: builtins.int
    ANALYSIS_FIELD_NUMBER: builtins.int
-    FLAVOR_FIELD_NUMBER: builtins.int
-    STATIC_ANALYSIS_FIELD_NUMBER: builtins.int
-    DYNAMIC_ANALYSIS_FIELD_NUMBER: builtins.int
    timestamp: builtins.str
    """iso8601 format, like: 2019-01-01T00:00:00Z"""
    version: builtins.str
@@ -900,16 +784,7 @@ class Metadata(google.protobuf.message.Message):
    @property
    def sample(self) -> global___Sample: ...
    @property
-    def analysis(self) -> global___Analysis:
-        """deprecated in v7.0.
-        use analysis2 instead.
-        """
-    flavor: global___Flavor.ValueType
-    @property
-    def static_analysis(self) -> global___StaticAnalysis:
-        """use analysis2 instead of analysis (deprecated in v7.0)."""
-    @property
-    def dynamic_analysis(self) -> global___DynamicAnalysis: ...
+    def analysis(self) -> global___Analysis: ...
    def __init__(
        self,
        *,
@@ -918,13 +793,9 @@ class Metadata(google.protobuf.message.Message):
        argv: collections.abc.Iterable[builtins.str] | None = ...,
        sample: global___Sample | None = ...,
        analysis: global___Analysis | None = ...,
-        flavor: global___Flavor.ValueType = ...,
-        static_analysis: global___StaticAnalysis | None = ...,
-        dynamic_analysis: global___DynamicAnalysis | None = ...,
    ) -> None: ...
-    def HasField(self, field_name: typing_extensions.Literal["analysis", b"analysis", "analysis2", b"analysis2", "dynamic_analysis", b"dynamic_analysis", "sample", b"sample", "static_analysis", b"static_analysis"]) -> builtins.bool: ...
-    def ClearField(self, field_name: typing_extensions.Literal["analysis", b"analysis", "analysis2", b"analysis2", "argv", b"argv", "dynamic_analysis", b"dynamic_analysis", "flavor", b"flavor", "sample", b"sample", "static_analysis", b"static_analysis", "timestamp", b"timestamp", "version", b"version"]) -> None: ...
-    def WhichOneof(self, oneof_group: typing_extensions.Literal["analysis2", b"analysis2"]) -> typing_extensions.Literal["static_analysis", "dynamic_analysis"] | None: ...
+    def HasField(self, field_name: typing_extensions.Literal["analysis", b"analysis", "sample", b"sample"]) -> builtins.bool: ...
+    def ClearField(self, field_name: typing_extensions.Literal["analysis", b"analysis", "argv", b"argv", "sample", b"sample", "timestamp", b"timestamp", "version", b"version"]) -> None: ...

 global___Metadata = Metadata

@@ -1102,50 +973,6 @@ class OperandOffsetFeature(google.protobuf.message.Message):

 global___OperandOffsetFeature = OperandOffsetFeature

-@typing_extensions.final
-class ProcessFeatureCount(google.protobuf.message.Message):
-    DESCRIPTOR: google.protobuf.descriptor.Descriptor
-
-    ADDRESS_FIELD_NUMBER: builtins.int
-    COUNT_FIELD_NUMBER: builtins.int
-    @property
-    def address(self) -> global___Address: ...
-    count: builtins.int
-    def __init__(
-        self,
-        *,
-        address: global___Address | None = ...,
-        count: builtins.int = ...,
-    ) -> None: ...
-    def HasField(self, field_name: typing_extensions.Literal["address", b"address"]) -> builtins.bool: ...
-    def ClearField(self, field_name: typing_extensions.Literal["address", b"address", "count", b"count"]) -> None: ...
-
-global___ProcessFeatureCount = ProcessFeatureCount
-
-@typing_extensions.final
-class ProcessLayout(google.protobuf.message.Message):
-    DESCRIPTOR: google.protobuf.descriptor.Descriptor
-
-    ADDRESS_FIELD_NUMBER: builtins.int
-    MATCHED_THREADS_FIELD_NUMBER: builtins.int
-    NAME_FIELD_NUMBER: builtins.int
-    @property
-    def address(self) -> global___Address: ...
-    @property
-    def matched_threads(self) -> google.protobuf.internal.containers.RepeatedCompositeFieldContainer[global___ThreadLayout]: ...
-    name: builtins.str
-    def __init__(
-        self,
-        *,
-        address: global___Address | None = ...,
-        matched_threads: collections.abc.Iterable[global___ThreadLayout] | None = ...,
-        name: builtins.str = ...,
-    ) -> None: ...
-    def HasField(self, field_name: typing_extensions.Literal["address", b"address"]) -> builtins.bool: ...
-    def ClearField(self, field_name: typing_extensions.Literal["address", b"address", "matched_threads", b"matched_threads", "name", b"name"]) -> None: ...
-
-global___ProcessLayout = ProcessLayout
-
@typing_extensions.final
 class PropertyFeature(google.protobuf.message.Message):
    DESCRIPTOR: google.protobuf.descriptor.Descriptor
@@ -1309,15 +1136,11 @@ class RuleMetadata(google.protobuf.message.Message):
    LIB_FIELD_NUMBER: builtins.int
    MAEC_FIELD_NUMBER: builtins.int
    IS_SUBSCOPE_RULE_FIELD_NUMBER: builtins.int
-    SCOPES_FIELD_NUMBER: builtins.int
    name: builtins.str
    namespace: builtins.str
    @property
    def authors(self) -> google.protobuf.internal.containers.RepeatedScalarFieldContainer[builtins.str]: ...
    scope: global___Scope.ValueType
-    """deprecated in v7.0.
-    use scopes instead.
-    """
    @property
    def attack(self) -> google.protobuf.internal.containers.RepeatedCompositeFieldContainer[global___AttackSpec]: ...
    @property
@@ -1331,9 +1154,6 @@ class RuleMetadata(google.protobuf.message.Message):
    @property
    def maec(self) -> global___MaecMetadata: ...
    is_subscope_rule: builtins.bool
-    @property
-    def scopes(self) -> global___Scopes:
-        """use scopes over scope (deprecated in v7.0)."""
    def __init__(
        self,
        *,
@@ -1349,10 +1169,9 @@ class RuleMetadata(google.protobuf.message.Message):
        lib: builtins.bool = ...,
        maec: global___MaecMetadata | None = ...,
        is_subscope_rule: builtins.bool = ...,
-        scopes: global___Scopes | None = ...,
    ) -> None: ...
-    def HasField(self, field_name: typing_extensions.Literal["maec", b"maec", "scopes", b"scopes"]) -> builtins.bool: ...
-    def ClearField(self, field_name: typing_extensions.Literal["attack", b"attack", "authors", b"authors", "description", b"description", "examples", b"examples", "is_subscope_rule", b"is_subscope_rule", "lib", b"lib", "maec", b"maec", "mbc", b"mbc", "name", b"name", "namespace", b"namespace", "references", b"references", "scope", b"scope", "scopes", b"scopes"]) -> None: ...
+    def HasField(self, field_name: typing_extensions.Literal["maec", b"maec"]) -> builtins.bool: ...
+    def ClearField(self, field_name: typing_extensions.Literal["attack", b"attack", "authors", b"authors", "description", b"description", "examples", b"examples", "is_subscope_rule", b"is_subscope_rule", "lib", b"lib", "maec", b"maec", "mbc", b"mbc", "name", b"name", "namespace", b"namespace", "references", b"references", "scope", b"scope"]) -> None: ...

 global___RuleMetadata = RuleMetadata

@@ -1380,29 +1199,6 @@ class Sample(google.protobuf.message.Message):

 global___Sample = Sample

-@typing_extensions.final
-class Scopes(google.protobuf.message.Message):
-    DESCRIPTOR: google.protobuf.descriptor.Descriptor
-
-    STATIC_FIELD_NUMBER: builtins.int
-    DYNAMIC_FIELD_NUMBER: builtins.int
-    static: global___Scope.ValueType
-    dynamic: global___Scope.ValueType
-    def __init__(
-        self,
-        *,
-        static: global___Scope.ValueType | None = ...,
-        dynamic: global___Scope.ValueType | None = ...,
-    ) -> None: ...
-    def HasField(self, field_name: typing_extensions.Literal["_dynamic", b"_dynamic", "_static", b"_static", "dynamic", b"dynamic", "static", b"static"]) -> builtins.bool: ...
-    def ClearField(self, field_name: typing_extensions.Literal["_dynamic", b"_dynamic", "_static", b"_static", "dynamic", b"dynamic", "static", b"static"]) -> None: ...
-    @typing.overload
-    def WhichOneof(self, oneof_group: typing_extensions.Literal["_dynamic", b"_dynamic"]) -> typing_extensions.Literal["dynamic"] | None: ...
-    @typing.overload
-    def WhichOneof(self, oneof_group: typing_extensions.Literal["_static", b"_static"]) -> typing_extensions.Literal["static"] | None: ...
-
-global___Scopes = Scopes
-
@typing_extensions.final
 class SectionFeature(google.protobuf.message.Message):
    DESCRIPTOR: google.protobuf.descriptor.Descriptor
@@ -1482,86 +1278,6 @@ class StatementNode(google.protobuf.message.Message):

 global___StatementNode = StatementNode

-@typing_extensions.final
-class StaticAnalysis(google.protobuf.message.Message):
-    DESCRIPTOR: google.protobuf.descriptor.Descriptor
-
-    FORMAT_FIELD_NUMBER: builtins.int
-    ARCH_FIELD_NUMBER: builtins.int
-    OS_FIELD_NUMBER: builtins.int
-    EXTRACTOR_FIELD_NUMBER: builtins.int
-    RULES_FIELD_NUMBER: builtins.int
-    BASE_ADDRESS_FIELD_NUMBER: builtins.int
-    LAYOUT_FIELD_NUMBER: builtins.int
-    FEATURE_COUNTS_FIELD_NUMBER: builtins.int
-    LIBRARY_FUNCTIONS_FIELD_NUMBER: builtins.int
-    format: builtins.str
-    arch: builtins.str
-    os: builtins.str
-    extractor: builtins.str
-    @property
-    def rules(self) -> google.protobuf.internal.containers.RepeatedScalarFieldContainer[builtins.str]: ...
-    @property
-    def base_address(self) -> global___Address: ...
-    @property
-    def layout(self) -> global___StaticLayout: ...
-    @property
-    def feature_counts(self) -> global___StaticFeatureCounts: ...
-    @property
-    def library_functions(self) -> google.protobuf.internal.containers.RepeatedCompositeFieldContainer[global___LibraryFunction]: ...
-    def __init__(
-        self,
-        *,
-        format: builtins.str = ...,
-        arch: builtins.str = ...,
-        os: builtins.str = ...,
-        extractor: builtins.str = ...,
-        rules: collections.abc.Iterable[builtins.str] | None = ...,
-        base_address: global___Address | None = ...,
-        layout: global___StaticLayout | None = ...,
-        feature_counts: global___StaticFeatureCounts | None = ...,
-        library_functions: collections.abc.Iterable[global___LibraryFunction] | None = ...,
-    ) -> None: ...
-    def HasField(self, field_name: typing_extensions.Literal["base_address", b"base_address", "feature_counts", b"feature_counts", "layout", b"layout"]) -> builtins.bool: ...
-    def ClearField(self, field_name: typing_extensions.Literal["arch", b"arch", "base_address", b"base_address", "extractor", b"extractor", "feature_counts", b"feature_counts", "format", b"format", "layout", b"layout", "library_functions", b"library_functions", "os", b"os", "rules", b"rules"]) -> None: ...
-
-global___StaticAnalysis = StaticAnalysis
-
-@typing_extensions.final
-class StaticFeatureCounts(google.protobuf.message.Message):
-    DESCRIPTOR: google.protobuf.descriptor.Descriptor
-
-    FILE_FIELD_NUMBER: builtins.int
-    FUNCTIONS_FIELD_NUMBER: builtins.int
-    file: builtins.int
-    @property
-    def functions(self) -> google.protobuf.internal.containers.RepeatedCompositeFieldContainer[global___FunctionFeatureCount]: ...
-    def __init__(
-        self,
-        *,
-        file: builtins.int = ...,
-        functions: collections.abc.Iterable[global___FunctionFeatureCount] | None = ...,
-    ) -> None: ...
-    def ClearField(self, field_name: typing_extensions.Literal["file", b"file", "functions", b"functions"]) -> None: ...
-
-global___StaticFeatureCounts = StaticFeatureCounts
-
-@typing_extensions.final
-class StaticLayout(google.protobuf.message.Message):
-    DESCRIPTOR: google.protobuf.descriptor.Descriptor
-
-    FUNCTIONS_FIELD_NUMBER: builtins.int
-    @property
-    def functions(self) -> google.protobuf.internal.containers.RepeatedCompositeFieldContainer[global___FunctionLayout]: ...
-    def __init__(
-        self,
-        *,
-        functions: collections.abc.Iterable[global___FunctionLayout] | None = ...,
-    ) -> None: ...
-    def ClearField(self, field_name: typing_extensions.Literal["functions", b"functions"]) -> None: ...
-
-global___StaticLayout = StaticLayout
-
@typing_extensions.final
 class StringFeature(google.protobuf.message.Message):
    DESCRIPTOR: google.protobuf.descriptor.Descriptor
@@ -1631,47 +1347,6 @@ class SubstringFeature(google.protobuf.message.Message):

 global___SubstringFeature = SubstringFeature

-@typing_extensions.final
-class CallLayout(google.protobuf.message.Message):
-    DESCRIPTOR: google.protobuf.descriptor.Descriptor
-
-    ADDRESS_FIELD_NUMBER: builtins.int
-    NAME_FIELD_NUMBER: builtins.int
-    @property
-    def address(self) -> global___Address: ...
-    name: builtins.str
-    def __init__(
-        self,
-        *,
-        address: global___Address | None = ...,
-        name: builtins.str = ...,
-    ) -> None: ...
-    def HasField(self, field_name: typing_extensions.Literal["address", b"address"]) -> builtins.bool: ...
-    def ClearField(self, field_name: typing_extensions.Literal["address", b"address", "name", b"name"]) -> None: ...
-
-global___CallLayout = CallLayout
-
-@typing_extensions.final
-class ThreadLayout(google.protobuf.message.Message):
-    DESCRIPTOR: google.protobuf.descriptor.Descriptor
-
-    ADDRESS_FIELD_NUMBER: builtins.int
-    MATCHED_CALLS_FIELD_NUMBER: builtins.int
-    @property
-    def address(self) -> global___Address: ...
-    @property
-    def matched_calls(self) -> google.protobuf.internal.containers.RepeatedCompositeFieldContainer[global___CallLayout]: ...
-    def __init__(
-        self,
-        *,
-        address: global___Address | None = ...,
-        matched_calls: collections.abc.Iterable[global___CallLayout] | None = ...,
-    ) -> None: ...
-    def HasField(self, field_name: typing_extensions.Literal["address", b"address"]) -> builtins.bool: ...
-    def ClearField(self, field_name: typing_extensions.Literal["address", b"address", "matched_calls", b"matched_calls"]) -> None: ...
-
-global___ThreadLayout = ThreadLayout
-
@typing_extensions.final
 class Addresses(google.protobuf.message.Message):
    DESCRIPTOR: google.protobuf.descriptor.Descriptor
@@ -1730,81 +1405,6 @@ class Token_Offset(google.protobuf.message.Message):

 global___Token_Offset = Token_Offset

-@typing_extensions.final
-class Ppid_Pid(google.protobuf.message.Message):
-    DESCRIPTOR: google.protobuf.descriptor.Descriptor
-
-    PPID_FIELD_NUMBER: builtins.int
-    PID_FIELD_NUMBER: builtins.int
-    @property
-    def ppid(self) -> global___Integer: ...
-    @property
-    def pid(self) -> global___Integer: ...
-    def __init__(
-        self,
-        *,
-        ppid: global___Integer | None = ...,
-        pid: global___Integer | None = ...,
-    ) -> None: ...
-    def HasField(self, field_name: typing_extensions.Literal["pid", b"pid", "ppid", b"ppid"]) -> builtins.bool: ...
-    def ClearField(self, field_name: typing_extensions.Literal["pid", b"pid", "ppid", b"ppid"]) -> None: ...
-
-global___Ppid_Pid = Ppid_Pid
-
-@typing_extensions.final
-class Ppid_Pid_Tid(google.protobuf.message.Message):
-    DESCRIPTOR: google.protobuf.descriptor.Descriptor
-
-    PPID_FIELD_NUMBER: builtins.int
-    PID_FIELD_NUMBER: builtins.int
-    TID_FIELD_NUMBER: builtins.int
-    @property
-    def ppid(self) -> global___Integer: ...
-    @property
-    def pid(self) -> global___Integer: ...
-    @property
-    def tid(self) -> global___Integer: ...
-    def __init__(
-        self,
-        *,
-        ppid: global___Integer | None = ...,
-        pid: global___Integer | None = ...,
-        tid: global___Integer | None = ...,
-    ) -> None: ...
-    def HasField(self, field_name: typing_extensions.Literal["pid", b"pid", "ppid", b"ppid", "tid", b"tid"]) -> builtins.bool: ...
-    def ClearField(self, field_name: typing_extensions.Literal["pid", b"pid", "ppid", b"ppid", "tid", b"tid"]) -> None: ...
-
-global___Ppid_Pid_Tid = Ppid_Pid_Tid
-
-@typing_extensions.final
-class Ppid_Pid_Tid_Id(google.protobuf.message.Message):
-    DESCRIPTOR: google.protobuf.descriptor.Descriptor
-
-    PPID_FIELD_NUMBER: builtins.int
-    PID_FIELD_NUMBER: builtins.int
-    TID_FIELD_NUMBER: builtins.int
-    ID_FIELD_NUMBER: builtins.int
-    @property
-    def ppid(self) -> global___Integer: ...
-    @property
-    def pid(self) -> global___Integer: ...
-    @property
-    def tid(self) -> global___Integer: ...
-    @property
-    def id(self) -> global___Integer: ...
-    def __init__(
-        self,
-        *,
-        ppid: global___Integer | None = ...,
-        pid: global___Integer | None = ...,
-        tid: global___Integer | None = ...,
-        id: global___Integer | None = ...,
-    ) -> None: ...
-    def HasField(self, field_name: typing_extensions.Literal["id", b"id", "pid", b"pid", "ppid", b"ppid", "tid", b"tid"]) -> builtins.bool: ...
-    def ClearField(self, field_name: typing_extensions.Literal["id", b"id", "pid", b"pid", "ppid", b"ppid", "tid", b"tid"]) -> None: ...
-
-global___Ppid_Pid_Tid_Id = Ppid_Pid_Tid_Id
-
@typing_extensions.final
 class Integer(google.protobuf.message.Message):
    DESCRIPTOR: google.protobuf.descriptor.Descriptor
--- a/capa/render/result_document.py
+++ b/capa/render/result_document.py
@@ -7,12 +7,9 @@
 # See the License for the specific language governing permissions and limitations under the License.
 import datetime
 import collections
-from enum import Enum
-from typing import Dict, List, Tuple, Union, Literal, Optional
-from pathlib import Path
+from typing import Dict, List, Tuple, Union, Optional

-from pydantic import Field, BaseModel, ConfigDict
-from typing_extensions import TypeAlias
+from pydantic import Field, BaseModel

 import capa.rules
 import capa.engine
@@ -26,11 +23,14 @@ from capa.helpers import assert_never


 class FrozenModel(BaseModel):
-    model_config = ConfigDict(frozen=True, extra="forbid")
+    class Config:
+        frozen = True
+        extra = "forbid"


 class Model(BaseModel):
-    model_config = ConfigDict(extra="forbid")
+    class Config:
+        extra = "forbid"


 class Sample(Model):
@@ -49,33 +49,10 @@ class FunctionLayout(Model):
    matched_basic_blocks: Tuple[BasicBlockLayout, ...]


-class CallLayout(Model):
-    address: frz.Address
-    name: str
-
-
-class ThreadLayout(Model):
-    address: frz.Address
-    matched_calls: Tuple[CallLayout, ...]
-
-
-class ProcessLayout(Model):
-    address: frz.Address
-    name: str
-    matched_threads: Tuple[ThreadLayout, ...]
-
-
-class StaticLayout(Model):
+class Layout(Model):
    functions: Tuple[FunctionLayout, ...]


-class DynamicLayout(Model):
-    processes: Tuple[ProcessLayout, ...]
-
-
-Layout: TypeAlias = Union[StaticLayout, DynamicLayout]
-
-
 class LibraryFunction(Model):
    address: frz.Address
    name: str
@@ -86,73 +63,31 @@ class FunctionFeatureCount(Model):
    count: int


-class ProcessFeatureCount(Model):
-    address: frz.Address
-    count: int
-
-
-class StaticFeatureCounts(Model):
+class FeatureCounts(Model):
    file: int
    functions: Tuple[FunctionFeatureCount, ...]


-class DynamicFeatureCounts(Model):
-    file: int
-    processes: Tuple[ProcessFeatureCount, ...]
-
-
-FeatureCounts: TypeAlias = Union[StaticFeatureCounts, DynamicFeatureCounts]
-
-
-class StaticAnalysis(Model):
+class Analysis(Model):
    format: str
    arch: str
    os: str
    extractor: str
    rules: Tuple[str, ...]
    base_address: frz.Address
-    layout: StaticLayout
-    feature_counts: StaticFeatureCounts
+    layout: Layout
+    feature_counts: FeatureCounts
    library_functions: Tuple[LibraryFunction, ...]


-class DynamicAnalysis(Model):
-    format: str
-    arch: str
-    os: str
-    extractor: str
-    rules: Tuple[str, ...]
-    layout: DynamicLayout
-    feature_counts: DynamicFeatureCounts
-
-
-Analysis: TypeAlias = Union[StaticAnalysis, DynamicAnalysis]
-
-
-class Flavor(str, Enum):
-    STATIC = "static"
-    DYNAMIC = "dynamic"
-
-
 class Metadata(Model):
    timestamp: datetime.datetime
    version: str
    argv: Optional[Tuple[str, ...]]
    sample: Sample
-    flavor: Flavor
    analysis: Analysis


-class StaticMetadata(Metadata):
-    flavor: Flavor = Flavor.STATIC
-    analysis: StaticAnalysis
-
-
-class DynamicMetadata(Metadata):
-    flavor: Flavor = Flavor.DYNAMIC
-    analysis: DynamicAnalysis
-
-
 class CompoundStatementType:
    AND = "and"
    OR = "or"
@@ -170,13 +105,13 @@ class CompoundStatement(StatementModel):


 class SomeStatement(StatementModel):
-    type: Literal["some"] = "some"
+    type = "some"
    description: Optional[str] = None
    count: int


 class RangeStatement(StatementModel):
-    type: Literal["range"] = "range"
+    type = "range"
    description: Optional[str] = None
    min: int
    max: int
@@ -184,7 +119,7 @@ class RangeStatement(StatementModel):


 class SubscopeStatement(StatementModel):
-    type: Literal["subscope"] = "subscope"
+    type = "subscope"
    description: Optional[str] = None
    scope: capa.rules.Scope

@@ -199,7 +134,7 @@ Statement = Union[


 class StatementNode(FrozenModel):
-    type: Literal["statement"] = "statement"
+    type = "statement"
    statement: Statement


@@ -222,7 +157,7 @@ def statement_from_capa(node: capa.engine.Statement) -> Statement:
            description=node.description,
            min=node.min,
            max=node.max,
-            child=frzf.feature_from_capa(node.child),
+            child=frz.feature_from_capa(node.child),
        )

    elif isinstance(node, capa.engine.Subscope):
@@ -236,7 +171,7 @@ def statement_from_capa(node: capa.engine.Statement) -> Statement:


 class FeatureNode(FrozenModel):
-    type: Literal["feature"] = "feature"
+    type = "feature"
    feature: frz.Feature


@@ -248,7 +183,7 @@ def node_from_capa(node: Union[capa.engine.Statement, capa.engine.Feature]) -> N
        return StatementNode(statement=statement_from_capa(node))

    elif isinstance(node, capa.engine.Feature):
-        return FeatureNode(feature=frzf.feature_from_capa(node))
+        return FeatureNode(feature=frz.feature_from_capa(node))

    else:
        assert_never(node)
@@ -375,11 +310,9 @@ class Match(FrozenModel):
                    # e.g. `contain loop/30c4c78e29bf4d54894fc74f664c62e8` -> `basic block`
                    #
                    # note! replace `node`
-                    # subscopes cannot have both a static and dynamic scope set
-                    assert None in (rule.scopes.static, rule.scopes.dynamic)
                    node = StatementNode(
                        statement=SubscopeStatement(
-                            scope=rule.scopes.static or rule.scopes.dynamic,
+                            scope=rule.meta["scope"],
                        )
                    )

@@ -567,14 +500,17 @@ class MaecMetadata(FrozenModel):
    malware_family: Optional[str] = Field(None, alias="malware-family")
    malware_category: Optional[str] = Field(None, alias="malware-category")
    malware_category_ov: Optional[str] = Field(None, alias="malware-category-ov")
-    model_config = ConfigDict(frozen=True, populate_by_name=True)
+
+    class Config:
+        frozen = True
+        allow_population_by_field_name = True


 class RuleMetadata(FrozenModel):
    name: str
-    namespace: Optional[str] = None
+    namespace: Optional[str]
    authors: Tuple[str, ...]
-    scopes: capa.rules.Scopes
+    scope: capa.rules.Scope
    attack: Tuple[AttackSpec, ...] = Field(alias="att&ck")
    mbc: Tuple[MBCSpec, ...]
    references: Tuple[str, ...]
@@ -591,7 +527,7 @@ class RuleMetadata(FrozenModel):
            name=rule.meta.get("name"),
            namespace=rule.meta.get("namespace"),
            authors=rule.meta.get("authors"),
-            scopes=capa.rules.Scopes.from_dict(rule.meta.get("scopes")),
+            scope=capa.rules.Scope(rule.meta.get("scope")),
            attack=tuple(map(AttackSpec.from_str, rule.meta.get("att&ck", []))),
            mbc=tuple(map(MBCSpec.from_str, rule.meta.get("mbc", []))),
            references=rule.meta.get("references", []),
@@ -610,7 +546,9 @@ class RuleMetadata(FrozenModel):
        )  # type: ignore
        # Mypy is unable to recognise arguments due to alias

-    model_config = ConfigDict(frozen=True, populate_by_name=True)
+    class Config:
+        frozen = True
+        allow_population_by_field_name = True


 class RuleMatches(FrozenModel):
@@ -666,7 +604,3 @@ class ResultDocument(FrozenModel):
                capabilities[rule_name].append((addr.to_capa(), result))

        return self.meta, capabilities
-
-    @classmethod
-    def from_file(cls, path: Path) -> "ResultDocument":
-        return cls.model_validate_json(path.read_text(encoding="utf-8"))
--- a/capa/render/utils.py
+++ b/capa/render/utils.py
@@ -24,11 +24,6 @@ def bold2(s: str) -> str:
    return termcolor.colored(s, "green")


-def mute(s: str) -> str:
-    """draw attention away from the given string"""
-    return termcolor.colored(s, "dark_grey")
-
-
 def warn(s: str) -> str:
    return termcolor.colored(s, "yellow")

--- a/capa/render/verbose.py
+++ b/capa/render/verbose.py
@@ -22,7 +22,7 @@ Unless required by applicable law or agreed to in writing, software distributed
 is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and limitations under the License.
 """
-from typing import cast
+import enum

 import tabulate

@@ -54,98 +54,13 @@ def format_address(address: frz.Address) -> str:
        assert isinstance(token, int)
        assert isinstance(offset, int)
        return f"token({capa.helpers.hex(token)})+{capa.helpers.hex(offset)}"
-    elif address.type == frz.AddressType.DEX_METHOD_INDEX:
-        assert isinstance(address.value, int)
-        return f"method({capa.helpers.hex(address.value)})"
-    elif address.type == frz.AddressType.DEX_CLASS_INDEX:
-        assert isinstance(address.value, int)
-        return f"class({capa.helpers.hex(address.value)})"
-    elif address.type == frz.AddressType.PROCESS:
-        assert isinstance(address.value, tuple)
-        ppid, pid = address.value
-        assert isinstance(ppid, int)
-        assert isinstance(pid, int)
-        return f"process{{pid:{pid}}}"
-    elif address.type == frz.AddressType.THREAD:
-        assert isinstance(address.value, tuple)
-        ppid, pid, tid = address.value
-        assert isinstance(ppid, int)
-        assert isinstance(pid, int)
-        assert isinstance(tid, int)
-        return f"process{{pid:{pid},tid:{tid}}}"
-    elif address.type == frz.AddressType.CALL:
-        assert isinstance(address.value, tuple)
-        ppid, pid, tid, id_ = address.value
-        return f"process{{pid:{pid},tid:{tid},call:{id_}}}"
    elif address.type == frz.AddressType.NO_ADDRESS:
        return "global"
    else:
        raise ValueError("unexpected address type")


-def _get_process_name(layout: rd.DynamicLayout, addr: frz.Address) -> str:
-    for p in layout.processes:
-        if p.address == addr:
-            return p.name
-
-    raise ValueError("name not found for process", addr)
-
-
-def _get_call_name(layout: rd.DynamicLayout, addr: frz.Address) -> str:
-    call = addr.to_capa()
-    assert isinstance(call, capa.features.address.DynamicCallAddress)
-
-    thread = frz.Address.from_capa(call.thread)
-    process = frz.Address.from_capa(call.thread.process)
-
-    # danger: O(n**3)
-    for p in layout.processes:
-        if p.address == process:
-            for t in p.matched_threads:
-                if t.address == thread:
-                    for c in t.matched_calls:
-                        if c.address == addr:
-                            return c.name
-    raise ValueError("name not found for call", addr)
-
-
-def render_process(layout: rd.DynamicLayout, addr: frz.Address) -> str:
-    process = addr.to_capa()
-    assert isinstance(process, capa.features.address.ProcessAddress)
-    name = _get_process_name(layout, addr)
-    return f"{name}{{pid:{process.pid}}}"
-
-
-def render_thread(layout: rd.DynamicLayout, addr: frz.Address) -> str:
-    thread = addr.to_capa()
-    assert isinstance(thread, capa.features.address.ThreadAddress)
-    name = _get_process_name(layout, frz.Address.from_capa(thread.process))
-    return f"{name}{{pid:{thread.process.pid},tid:{thread.tid}}}"
-
-
-def render_call(layout: rd.DynamicLayout, addr: frz.Address) -> str:
-    call = addr.to_capa()
-    assert isinstance(call, capa.features.address.DynamicCallAddress)
-
-    pname = _get_process_name(layout, frz.Address.from_capa(call.thread.process))
-    cname = _get_call_name(layout, addr)
-
-    fname, _, rest = cname.partition("(")
-    args, _, rest = rest.rpartition(")")
-
-    s = []
-    s.append(f"{fname}(")
-    for arg in args.split(", "):
-        s.append(f"  {arg},")
-    s.append(f"){rest}")
-
-    newline = "\n"
-    return (
-        f"{pname}{{pid:{call.thread.process.pid},tid:{call.thread.tid},call:{call.id}}}\n{rutils.mute(newline.join(s))}"
-    )
-
-
-def render_static_meta(ostream, meta: rd.StaticMetadata):
+def render_meta(ostream, doc: rd.ResultDocument):
    """
    like:

@@ -158,90 +73,36 @@ def render_static_meta(ostream, meta: rd.StaticMetadata):
        os                   windows
        format               pe
        arch                 amd64
-        analysis             static
        extractor            VivisectFeatureExtractor
        base address         0x10000000
        rules                (embedded rules)
        function count       42
        total feature count  1918
    """
-
    rows = [
-        ("md5", meta.sample.md5),
-        ("sha1", meta.sample.sha1),
-        ("sha256", meta.sample.sha256),
-        ("path", meta.sample.path),
-        ("timestamp", meta.timestamp),
-        ("capa version", meta.version),
-        ("os", meta.analysis.os),
-        ("format", meta.analysis.format),
-        ("arch", meta.analysis.arch),
-        ("analysis", meta.flavor.value),
-        ("extractor", meta.analysis.extractor),
-        ("base address", format_address(meta.analysis.base_address)),
-        ("rules", "\n".join(meta.analysis.rules)),
-        ("function count", len(meta.analysis.feature_counts.functions)),
-        ("library function count", len(meta.analysis.library_functions)),
+        ("md5", doc.meta.sample.md5),
+        ("sha1", doc.meta.sample.sha1),
+        ("sha256", doc.meta.sample.sha256),
+        ("path", doc.meta.sample.path),
+        ("timestamp", doc.meta.timestamp),
+        ("capa version", doc.meta.version),
+        ("os", doc.meta.analysis.os),
+        ("format", doc.meta.analysis.format),
+        ("arch", doc.meta.analysis.arch),
+        ("extractor", doc.meta.analysis.extractor),
+        ("base address", format_address(doc.meta.analysis.base_address)),
+        ("rules", "\n".join(doc.meta.analysis.rules)),
+        ("function count", len(doc.meta.analysis.feature_counts.functions)),
+        ("library function count", len(doc.meta.analysis.library_functions)),
        (
            "total feature count",
-            meta.analysis.feature_counts.file + sum(f.count for f in meta.analysis.feature_counts.functions),
+            doc.meta.analysis.feature_counts.file + sum(f.count for f in doc.meta.analysis.feature_counts.functions),
        ),
    ]

    ostream.writeln(tabulate.tabulate(rows, tablefmt="plain"))


-def render_dynamic_meta(ostream, meta: rd.DynamicMetadata):
-    """
-    like:
-
-        md5                  84882c9d43e23d63b82004fae74ebb61
-        sha1                 c6fb3b50d946bec6f391aefa4e54478cf8607211
-        sha256               5eced7367ed63354b4ed5c556e2363514293f614c2c2eb187273381b2ef5f0f9
-        path                 /tmp/packed-report,jspn
-        timestamp            2023-07-17T10:17:05.796933
-        capa version         0.0.0
-        os                   windows
-        format               pe
-        arch                 amd64
-        extractor            CAPEFeatureExtractor
-        rules                (embedded rules)
-        process count        42
-        total feature count  1918
-    """
-
-    rows = [
-        ("md5", meta.sample.md5),
-        ("sha1", meta.sample.sha1),
-        ("sha256", meta.sample.sha256),
-        ("path", meta.sample.path),
-        ("timestamp", meta.timestamp),
-        ("capa version", meta.version),
-        ("os", meta.analysis.os),
-        ("format", meta.analysis.format),
-        ("arch", meta.analysis.arch),
-        ("analysis", meta.flavor.value),
-        ("extractor", meta.analysis.extractor),
-        ("rules", "\n".join(meta.analysis.rules)),
-        ("process count", len(meta.analysis.feature_counts.processes)),
-        (
-            "total feature count",
-            meta.analysis.feature_counts.file + sum(p.count for p in meta.analysis.feature_counts.processes),
-        ),
-    ]
-
-    ostream.writeln(tabulate.tabulate(rows, tablefmt="plain"))
-
-
-def render_meta(osstream, doc: rd.ResultDocument):
-    if doc.meta.flavor == rd.Flavor.STATIC:
-        render_static_meta(osstream, cast(rd.StaticMetadata, doc.meta))
-    elif doc.meta.flavor == rd.Flavor.DYNAMIC:
-        render_dynamic_meta(osstream, cast(rd.DynamicMetadata, doc.meta))
-    else:
-        raise ValueError("invalid meta analysis")
-
-
 def render_rules(ostream, doc: rd.ResultDocument):
    """
    like:
@@ -265,55 +126,22 @@ def render_rules(ostream, doc: rd.ResultDocument):
        had_match = True

        rows = []
+        for key in ("namespace", "description", "scope"):
+            v = getattr(rule.meta, key)
+            if not v:
+                continue

-        ns = rule.meta.namespace
-        if ns:
-            rows.append(("namespace", ns))
+            if isinstance(v, list) and len(v) == 1:
+                v = v[0]

-        desc = rule.meta.description
-        if desc:
-            rows.append(("description", desc))
+            if isinstance(v, enum.Enum):
+                v = v.value

-        if doc.meta.flavor == rd.Flavor.STATIC:
-            scope = rule.meta.scopes.static
-        elif doc.meta.flavor == rd.Flavor.DYNAMIC:
-            scope = rule.meta.scopes.dynamic
-        else:
-            raise ValueError("invalid meta analysis")
-        if scope:
-            rows.append(("scope", scope.value))
+            rows.append((key, v))

-        if capa.rules.Scope.FILE not in rule.meta.scopes:
+        if rule.meta.scope != capa.rules.FILE_SCOPE:
            locations = [m[0] for m in doc.rules[rule.meta.name].matches]
-            lines = []
-
-            if doc.meta.flavor == rd.Flavor.STATIC:
-                lines = [format_address(loc) for loc in locations]
-            elif doc.meta.flavor == rd.Flavor.DYNAMIC:
-                assert rule.meta.scopes.dynamic is not None
-                assert isinstance(doc.meta.analysis.layout, rd.DynamicLayout)
-
-                if rule.meta.scopes.dynamic == capa.rules.Scope.PROCESS:
-                    lines = [render_process(doc.meta.analysis.layout, loc) for loc in locations]
-                elif rule.meta.scopes.dynamic == capa.rules.Scope.THREAD:
-                    lines = [render_thread(doc.meta.analysis.layout, loc) for loc in locations]
-                elif rule.meta.scopes.dynamic == capa.rules.Scope.CALL:
-                    # because we're only in verbose mode, we won't show the full call details (name, args, retval)
-                    # we'll only show the details of the thread in which the calls are found.
-                    # so select the thread locations and render those.
-                    thread_locations = set()
-                    for loc in locations:
-                        cloc = loc.to_capa()
-                        assert isinstance(cloc, capa.features.address.DynamicCallAddress)
-                        thread_locations.add(frz.Address.from_capa(cloc.thread))
-
-                    lines = [render_thread(doc.meta.analysis.layout, loc) for loc in thread_locations]
-                else:
-                    capa.helpers.assert_never(rule.meta.scopes.dynamic)
-            else:
-                capa.helpers.assert_never(doc.meta.flavor)
-
-            rows.append(("matches", "\n".join(lines)))
+            rows.append(("matches", "\n".join(map(format_address, locations))))

        ostream.writeln(tabulate.tabulate(rows, tablefmt="plain"))
        ostream.write("\n")
--- a/capa/render/vverbose.py
+++ b/capa/render/vverbose.py
@@ -5,8 +5,7 @@
 # Unless required by applicable law or agreed to in writing, software distributed under the License
 #  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and limitations under the License.
-import logging
-import textwrap
+
 from typing import Dict, Iterable, Optional

 import tabulate
@@ -23,29 +22,8 @@ import capa.features.freeze.features as frzf
 from capa.rules import RuleSet
 from capa.engine import MatchResults

-logger = logging.getLogger(__name__)

-
-def hanging_indent(s: str, indent: int) -> str:
-    """
-    indent the given string, except the first line,
-    such as if the string finishes an existing line.
-
-    e.g.,
-
-        EXISTINGSTUFFHERE + hanging_indent("xxxx...", 1)
-
-    becomes:
-
-        EXISTINGSTUFFHERExxxxx
-          xxxxxx
-          xxxxxx
-    """
-    prefix = "  " * indent
-    return textwrap.indent(s, prefix=prefix)[len(prefix) :]
-
-
-def render_locations(ostream, layout: rd.Layout, locations: Iterable[frz.Address], indent: int):
+def render_locations(ostream, locations: Iterable[frz.Address]):
    import capa.render.verbose as v

    # its possible to have an empty locations array here,
@@ -57,23 +35,9 @@ def render_locations(ostream, layout: rd.Layout, locations: Iterable[frz.Address
        return

    ostream.write(" @ ")
-    location0 = locations[0]

    if len(locations) == 1:
-        location = locations[0]
-
-        if location.type == frz.AddressType.CALL:
-            assert isinstance(layout, rd.DynamicLayout)
-            ostream.write(hanging_indent(v.render_call(layout, location), indent + 1))
-        else:
-            ostream.write(v.format_address(locations[0]))
-
-    elif location0.type == frz.AddressType.CALL and len(locations) > 1:
-        location = locations[0]
-
-        assert isinstance(layout, rd.DynamicLayout)
-        s = f"{v.render_call(layout, location)}\nand {(len(locations) - 1)} more..."
-        ostream.write(hanging_indent(s, indent + 1))
+        ostream.write(v.format_address(locations[0]))

    elif len(locations) > 4:
        # don't display too many locations, because it becomes very noisy.
@@ -88,7 +52,7 @@ def render_locations(ostream, layout: rd.Layout, locations: Iterable[frz.Address
        raise RuntimeError("unreachable")


-def render_statement(ostream, layout: rd.Layout, match: rd.Match, statement: rd.Statement, indent: int):
+def render_statement(ostream, match: rd.Match, statement: rd.Statement, indent=0):
    ostream.write("  " * indent)

    if isinstance(statement, rd.SubscopeStatement):
@@ -124,7 +88,7 @@ def render_statement(ostream, layout: rd.Layout, match: rd.Match, statement: rd.
        # so, we have to inline some of the feature rendering here.

        child = statement.child
-        value = child.model_dump(by_alias=True).get(child.type)
+        value = child.dict(by_alias=True).get(child.type)

        if value:
            if isinstance(child, frzf.StringFeature):
@@ -150,7 +114,7 @@ def render_statement(ostream, layout: rd.Layout, match: rd.Match, statement: rd.

        if statement.description:
            ostream.write(f" = {statement.description}")
-        render_locations(ostream, layout, match.locations, indent)
+        render_locations(ostream, match.locations)
        ostream.writeln("")

    else:
@@ -161,9 +125,7 @@ def render_string_value(s: str) -> str:
    return f'"{capa.features.common.escape_string(s)}"'


-def render_feature(
-    ostream, layout: rd.Layout, rule: rd.RuleMatches, match: rd.Match, feature: frzf.Feature, indent: int
-):
+def render_feature(ostream, match: rd.Match, feature: frzf.Feature, indent=0):
    ostream.write("  " * indent)

    key = feature.type
@@ -179,7 +141,7 @@ def render_feature(
        value = feature.class_
    else:
        # convert attributes to dictionary using aliased names, if applicable
-        value = feature.model_dump(by_alias=True).get(key)
+        value = feature.dict(by_alias=True).get(key)

    if value is None:
        raise ValueError(f"{key} contains None")
@@ -214,17 +176,8 @@ def render_feature(
                ostream.write(capa.rules.DESCRIPTION_SEPARATOR)
                ostream.write(feature.description)

-        if isinstance(feature, (frzf.OSFeature, frzf.ArchFeature, frzf.FormatFeature)):
-            # don't show the location of these global features
-            pass
-        elif isinstance(layout, rd.DynamicLayout) and rule.meta.scopes.dynamic == capa.rules.Scope.CALL:
-            # if we're in call scope, then the call will have been rendered at the top
-            # of the output, so don't re-render it again for each feature.
-            pass
-        elif isinstance(feature, (frzf.OSFeature, frzf.ArchFeature, frzf.FormatFeature)):
-            pass
-        else:
-            render_locations(ostream, layout, match.locations, indent)
+        if not isinstance(feature, (frzf.OSFeature, frzf.ArchFeature, frzf.FormatFeature)):
+            render_locations(ostream, match.locations)
        ostream.write("\n")
    else:
        # like:
@@ -240,19 +193,15 @@ def render_feature(
            ostream.write("  " * (indent + 1))
            ostream.write("- ")
            ostream.write(rutils.bold2(render_string_value(capture)))
-            if isinstance(layout, rd.DynamicLayout) and rule.meta.scopes.dynamic == capa.rules.Scope.CALL:
-                # like above, don't re-render calls when in call scope.
-                pass
-            else:
-                render_locations(ostream, layout, locations, indent=indent)
+            render_locations(ostream, locations)
            ostream.write("\n")


-def render_node(ostream, layout: rd.Layout, rule: rd.RuleMatches, match: rd.Match, node: rd.Node, indent: int):
+def render_node(ostream, match: rd.Match, node: rd.Node, indent=0):
    if isinstance(node, rd.StatementNode):
-        render_statement(ostream, layout, match, node.statement, indent=indent)
+        render_statement(ostream, match, node.statement, indent=indent)
    elif isinstance(node, rd.FeatureNode):
-        render_feature(ostream, layout, rule, match, node.feature, indent=indent)
+        render_feature(ostream, match, node.feature, indent=indent)
    else:
        raise RuntimeError("unexpected node type: " + str(node))

@@ -265,7 +214,7 @@ MODE_SUCCESS = "success"
 MODE_FAILURE = "failure"


-def render_match(ostream, layout: rd.Layout, rule: rd.RuleMatches, match: rd.Match, indent=0, mode=MODE_SUCCESS):
+def render_match(ostream, match: rd.Match, indent=0, mode=MODE_SUCCESS):
    child_mode = mode
    if mode == MODE_SUCCESS:
        # display only nodes that evaluated successfully.
@@ -297,10 +246,10 @@ def render_match(ostream, layout: rd.Layout, rule: rd.RuleMatches, match: rd.Mat
    else:
        raise RuntimeError("unexpected mode: " + mode)

-    render_node(ostream, layout, rule, match, match.node, indent=indent)
+    render_node(ostream, match, match.node, indent=indent)

    for child in match.children:
-        render_match(ostream, layout, rule, child, indent=indent + 1, mode=child_mode)
+        render_match(ostream, child, indent=indent + 1, mode=child_mode)


 def render_rules(ostream, doc: rd.ResultDocument):
@@ -311,8 +260,7 @@ def render_rules(ostream, doc: rd.ResultDocument):
        check for OutputDebugString error
        namespace  anti-analysis/anti-debugging/debugger-detection
        author     michael.hunhoff@mandiant.com
-        static scope:   function
-        dynamic scope:  process
+        scope      function
        mbc        Anti-Behavioral Analysis::Detect Debugger::OutputDebugString
        function @ 0x10004706
          and:
@@ -320,20 +268,13 @@ def render_rules(ostream, doc: rd.ResultDocument):
            api: kernel32.GetLastError @ 0x10004A87
            api: kernel32.OutputDebugString @ 0x10004767, 0x10004787, 0x10004816, 0x10004895
    """
-    import capa.render.verbose as v
-
    functions_by_bb: Dict[capa.features.address.Address, capa.features.address.Address] = {}
-    if isinstance(doc.meta.analysis, rd.StaticAnalysis):
-        for finfo in doc.meta.analysis.layout.functions:
-            faddress = finfo.address.to_capa()
+    for finfo in doc.meta.analysis.layout.functions:
+        faddress = finfo.address.to_capa()

-            for bb in finfo.matched_basic_blocks:
-                bbaddress = bb.address.to_capa()
-                functions_by_bb[bbaddress] = faddress
-    elif isinstance(doc.meta.analysis, rd.DynamicAnalysis):
-        pass
-    else:
-        raise ValueError("invalid analysis field in the document's meta")
+        for bb in finfo.matched_basic_blocks:
+            bbaddress = bb.address.to_capa()
+            functions_by_bb[bbaddress] = faddress

    had_match = False

@@ -382,13 +323,7 @@ def render_rules(ostream, doc: rd.ResultDocument):

        rows.append(("author", ", ".join(rule.meta.authors)))

-        if doc.meta.flavor == rd.Flavor.STATIC:
-            assert rule.meta.scopes.static is not None
-            rows.append(("scope", rule.meta.scopes.static.value))
-
-        if doc.meta.flavor == rd.Flavor.DYNAMIC:
-            assert rule.meta.scopes.dynamic is not None
-            rows.append(("scope", rule.meta.scopes.dynamic.value))
+        rows.append(("scope", rule.meta.scope.value))

        if rule.meta.attack:
            rows.append(("att&ck", ", ".join([rutils.format_parts_id(v) for v in rule.meta.attack])))
@@ -404,7 +339,7 @@ def render_rules(ostream, doc: rd.ResultDocument):

        ostream.writeln(tabulate.tabulate(rows, tablefmt="plain"))

-        if capa.rules.Scope.FILE in rule.meta.scopes:
+        if rule.meta.scope == capa.rules.FILE_SCOPE:
            matches = doc.rules[rule.meta.name].matches
            if len(matches) != 1:
                # i think there should only ever be one match per file-scope rule,
@@ -412,42 +347,22 @@ def render_rules(ostream, doc: rd.ResultDocument):
                # but i'm not 100% sure if this is/will always be true.
                # so, lets be explicit about our assumptions and raise an exception if they fail.
                raise RuntimeError(f"unexpected file scope match count: {len(matches)}")
-            _, first_match = matches[0]
-            render_match(ostream, doc.meta.analysis.layout, rule, first_match, indent=0)
+            first_address, first_match = matches[0]
+            render_match(ostream, first_match, indent=0)
        else:
            for location, match in sorted(doc.rules[rule.meta.name].matches):
-                if doc.meta.flavor == rd.Flavor.STATIC:
-                    assert rule.meta.scopes.static is not None
-                    ostream.write(rule.meta.scopes.static.value)
-                    ostream.write(" @ ")
-                    ostream.write(capa.render.verbose.format_address(location))
+                ostream.write(rule.meta.scope)
+                ostream.write(" @ ")
+                ostream.write(capa.render.verbose.format_address(location))

-                    if rule.meta.scopes.static == capa.rules.Scope.BASIC_BLOCK:
-                        func = frz.Address.from_capa(functions_by_bb[location.to_capa()])
-                        ostream.write(f" in function {capa.render.verbose.format_address(func)}")
-
-                elif doc.meta.flavor == rd.Flavor.DYNAMIC:
-                    assert rule.meta.scopes.dynamic is not None
-                    assert isinstance(doc.meta.analysis.layout, rd.DynamicLayout)
-
-                    ostream.write(rule.meta.scopes.dynamic.value)
-
-                    ostream.write(" @ ")
-
-                    if rule.meta.scopes.dynamic == capa.rules.Scope.PROCESS:
-                        ostream.write(v.render_process(doc.meta.analysis.layout, location))
-                    elif rule.meta.scopes.dynamic == capa.rules.Scope.THREAD:
-                        ostream.write(v.render_thread(doc.meta.analysis.layout, location))
-                    elif rule.meta.scopes.dynamic == capa.rules.Scope.CALL:
-                        ostream.write(hanging_indent(v.render_call(doc.meta.analysis.layout, location), indent=1))
-                    else:
-                        capa.helpers.assert_never(rule.meta.scopes.dynamic)
-
-                else:
-                    capa.helpers.assert_never(doc.meta.flavor)
+                if rule.meta.scope == capa.rules.BASIC_BLOCK_SCOPE:
+                    ostream.write(
+                        " in function "
+                        + capa.render.verbose.format_address(frz.Address.from_capa(functions_by_bb[location.to_capa()]))
+                    )

                ostream.write("\n")
-                render_match(ostream, doc.meta.analysis.layout, rule, match, indent=1)
+                render_match(ostream, match, indent=1)
                if rule.meta.lib:
                    # only show first match
                    break
--- a/capa/rules/init.py
+++ b/capa/rules/init.py
@@ -8,8 +8,6 @@

 import io
 import re
-import gzip
-import json
 import uuid
 import codecs
 import logging
@@ -27,8 +25,7 @@ except ImportError:
    # https://github.com/python/mypy/issues/1153
    from backports.functools_lru_cache import lru_cache  # type: ignore

-from typing import Any, Set, Dict, List, Tuple, Union, Iterator, Optional
-from dataclasses import asdict, dataclass
+from typing import Any, Set, Dict, List, Tuple, Union, Iterator

 import yaml
 import pydantic
@@ -62,7 +59,7 @@ META_KEYS = (
    "authors",
    "description",
    "lib",
-    "scopes",
+    "scope",
    "att&ck",
    "mbc",
    "references",
@@ -77,113 +74,28 @@ HIDDEN_META_KEYS = ("capa/nursery", "capa/path")

 class Scope(str, Enum):
    FILE = "file"
-    PROCESS = "process"
-    THREAD = "thread"
-    CALL = "call"
    FUNCTION = "function"
    BASIC_BLOCK = "basic block"
    INSTRUCTION = "instruction"

-    # used only to specify supported features per scope.
-    # not used to validate rules.
-    GLOBAL = "global"

-    @classmethod
-    def to_yaml(cls, representer, node):
-        return representer.represent_str(f"{node.value}")
-
-
-# these literals are used to check if the flavor
-# of a rule is correct.
-STATIC_SCOPES = {
-    Scope.FILE,
-    Scope.GLOBAL,
-    Scope.FUNCTION,
-    Scope.BASIC_BLOCK,
-    Scope.INSTRUCTION,
-}
-DYNAMIC_SCOPES = {
-    Scope.FILE,
-    Scope.GLOBAL,
-    Scope.PROCESS,
-    Scope.THREAD,
-    Scope.CALL,
-}
-
-
-@dataclass
-class Scopes:
-    # when None, the scope is not supported by a rule
-    static: Optional[Scope] = None
-    # when None, the scope is not supported by a rule
-    dynamic: Optional[Scope] = None
-
-    def __contains__(self, scope: Scope) -> bool:
-        return (scope == self.static) or (scope == self.dynamic)
-
-    def __repr__(self) -> str:
-        if self.static and self.dynamic:
-            return f"static-scope: {self.static}, dynamic-scope: {self.dynamic}"
-        elif self.static:
-            return f"static-scope: {self.static}"
-        elif self.dynamic:
-            return f"dynamic-scope: {self.dynamic}"
-        else:
-            raise ValueError("invalid rules class. at least one scope must be specified")
-
-    @classmethod
-    def from_dict(self, scopes: Dict[str, str]) -> "Scopes":
-        # make local copy so we don't make changes outside of this routine.
-        # we'll use the value None to indicate the scope is not supported.
-        scopes_: Dict[str, Optional[str]] = dict(scopes)
-
-        # mark non-specified scopes as invalid
-        if "static" not in scopes_:
-            raise InvalidRule("static scope must be provided")
-        if "dynamic" not in scopes_:
-            raise InvalidRule("dynamic scope must be provided")
-
-        # check the syntax of the meta `scopes` field
-        if sorted(scopes_) != ["dynamic", "static"]:
-            raise InvalidRule("scope flavors can be either static or dynamic")
-
-        if scopes_["static"] == "unsupported":
-            scopes_["static"] = None
-        if scopes_["dynamic"] == "unsupported":
-            scopes_["dynamic"] = None
-
-        # unspecified is used to indicate a rule is yet to be migrated.
-        # TODO(williballenthin): this scope term should be removed once all rules have been migrated.
-        # https://github.com/mandiant/capa/issues/1747
-        if scopes_["static"] == "unspecified":
-            scopes_["static"] = None
-        if scopes_["dynamic"] == "unspecified":
-            scopes_["dynamic"] = None
-
-        if (not scopes_["static"]) and (not scopes_["dynamic"]):
-            raise InvalidRule("invalid scopes value. At least one scope must be specified")
-
-        # check that all the specified scopes are valid
-        if scopes_["static"] and scopes_["static"] not in STATIC_SCOPES:
-            raise InvalidRule(f"{scopes_['static']} is not a valid static scope")
-
-        if scopes_["dynamic"] and scopes_["dynamic"] not in DYNAMIC_SCOPES:
-            raise InvalidRule(f"{scopes_['dynamic']} is not a valid dynamic scope")
-
-        return Scopes(
-            static=Scope(scopes_["static"]) if scopes_["static"] else None,
-            dynamic=Scope(scopes_["dynamic"]) if scopes_["dynamic"] else None,
-        )
+FILE_SCOPE = Scope.FILE.value
+FUNCTION_SCOPE = Scope.FUNCTION.value
+BASIC_BLOCK_SCOPE = Scope.BASIC_BLOCK.value
+INSTRUCTION_SCOPE = Scope.INSTRUCTION.value
+# used only to specify supported features per scope.
+# not used to validate rules.
+GLOBAL_SCOPE = "global"


 SUPPORTED_FEATURES: Dict[str, Set] = {
-    Scope.GLOBAL: {
+    GLOBAL_SCOPE: {
        # these will be added to other scopes, see below.
        capa.features.common.OS,
        capa.features.common.Arch,
        capa.features.common.Format,
    },
-    Scope.FILE: {
+    FILE_SCOPE: {
        capa.features.common.MatchedRule,
        capa.features.file.Export,
        capa.features.file.Import,
@@ -194,21 +106,8 @@ SUPPORTED_FEATURES: Dict[str, Set] = {
        capa.features.common.Class,
        capa.features.common.Namespace,
        capa.features.common.Characteristic("mixed mode"),
-        capa.features.common.Characteristic("forwarded export"),
    },
-    Scope.PROCESS: {
-        capa.features.common.MatchedRule,
-    },
-    Scope.THREAD: set(),
-    Scope.CALL: {
-        capa.features.common.MatchedRule,
-        capa.features.common.Regex,
-        capa.features.common.String,
-        capa.features.common.Substring,
-        capa.features.insn.API,
-        capa.features.insn.Number,
-    },
-    Scope.FUNCTION: {
+    FUNCTION_SCOPE: {
        capa.features.common.MatchedRule,
        capa.features.basicblock.BasicBlock,
        capa.features.common.Characteristic("calls from"),
@@ -217,13 +116,13 @@ SUPPORTED_FEATURES: Dict[str, Set] = {
        capa.features.common.Characteristic("recursive call"),
        # plus basic block scope features, see below
    },
-    Scope.BASIC_BLOCK: {
+    BASIC_BLOCK_SCOPE: {
        capa.features.common.MatchedRule,
        capa.features.common.Characteristic("tight loop"),
        capa.features.common.Characteristic("stack string"),
        # plus instruction scope features, see below
    },
-    Scope.INSTRUCTION: {
+    INSTRUCTION_SCOPE: {
        capa.features.common.MatchedRule,
        capa.features.insn.API,
        capa.features.insn.Property,
@@ -248,24 +147,15 @@ SUPPORTED_FEATURES: Dict[str, Set] = {
 }

 # global scope features are available in all other scopes
-SUPPORTED_FEATURES[Scope.INSTRUCTION].update(SUPPORTED_FEATURES[Scope.GLOBAL])
-SUPPORTED_FEATURES[Scope.BASIC_BLOCK].update(SUPPORTED_FEATURES[Scope.GLOBAL])
-SUPPORTED_FEATURES[Scope.FUNCTION].update(SUPPORTED_FEATURES[Scope.GLOBAL])
-SUPPORTED_FEATURES[Scope.FILE].update(SUPPORTED_FEATURES[Scope.GLOBAL])
-SUPPORTED_FEATURES[Scope.PROCESS].update(SUPPORTED_FEATURES[Scope.GLOBAL])
-SUPPORTED_FEATURES[Scope.THREAD].update(SUPPORTED_FEATURES[Scope.GLOBAL])
-SUPPORTED_FEATURES[Scope.CALL].update(SUPPORTED_FEATURES[Scope.GLOBAL])
-
-
-# all call scope features are also thread features
-SUPPORTED_FEATURES[Scope.THREAD].update(SUPPORTED_FEATURES[Scope.CALL])
-# all thread scope features are also process features
-SUPPORTED_FEATURES[Scope.PROCESS].update(SUPPORTED_FEATURES[Scope.THREAD])
+SUPPORTED_FEATURES[INSTRUCTION_SCOPE].update(SUPPORTED_FEATURES[GLOBAL_SCOPE])
+SUPPORTED_FEATURES[BASIC_BLOCK_SCOPE].update(SUPPORTED_FEATURES[GLOBAL_SCOPE])
+SUPPORTED_FEATURES[FUNCTION_SCOPE].update(SUPPORTED_FEATURES[GLOBAL_SCOPE])
+SUPPORTED_FEATURES[FILE_SCOPE].update(SUPPORTED_FEATURES[GLOBAL_SCOPE])

 # all instruction scope features are also basic block features
-SUPPORTED_FEATURES[Scope.BASIC_BLOCK].update(SUPPORTED_FEATURES[Scope.INSTRUCTION])
+SUPPORTED_FEATURES[BASIC_BLOCK_SCOPE].update(SUPPORTED_FEATURES[INSTRUCTION_SCOPE])
 # all basic block scope features are also function scope features
-SUPPORTED_FEATURES[Scope.FUNCTION].update(SUPPORTED_FEATURES[Scope.BASIC_BLOCK])
+SUPPORTED_FEATURES[FUNCTION_SCOPE].update(SUPPORTED_FEATURES[BASIC_BLOCK_SCOPE])


 class InvalidRule(ValueError):
@@ -303,91 +193,22 @@ class InvalidRuleSet(ValueError):
        return str(self)


-def ensure_feature_valid_for_scopes(scopes: Scopes, feature: Union[Feature, Statement]):
-    # construct a dict of all supported features
-    supported_features: Set = set()
-    if scopes.static:
-        supported_features.update(SUPPORTED_FEATURES[scopes.static])
-    if scopes.dynamic:
-        supported_features.update(SUPPORTED_FEATURES[scopes.dynamic])
-
+def ensure_feature_valid_for_scope(scope: str, feature: Union[Feature, Statement]):
    # if the given feature is a characteristic,
    # check that is a valid characteristic for the given scope.
    if (
        isinstance(feature, capa.features.common.Characteristic)
        and isinstance(feature.value, str)
-        and capa.features.common.Characteristic(feature.value) not in supported_features
+        and capa.features.common.Characteristic(feature.value) not in SUPPORTED_FEATURES[scope]
    ):
-        raise InvalidRule(f"feature {feature} not supported for scopes {scopes}")
+        raise InvalidRule(f"feature {feature} not supported for scope {scope}")

    if not isinstance(feature, capa.features.common.Characteristic):
        # features of this scope that are not Characteristics will be Type instances.
        # check that the given feature is one of these types.
-        types_for_scope = filter(lambda t: isinstance(t, type), supported_features)
-        if not isinstance(feature, tuple(types_for_scope)):
-            raise InvalidRule(f"feature {feature} not supported for scopes {scopes}")
-
-
-class ComType(Enum):
-    CLASS = "class"
-    INTERFACE = "interface"
-
-
-# COM data source https://github.com/stevemk14ebr/COM-Code-Helper/tree/master
-VALID_COM_TYPES = {
-    ComType.CLASS: {"db_path": "assets/classes.json.gz", "prefix": "CLSID_"},
-    ComType.INTERFACE: {"db_path": "assets/interfaces.json.gz", "prefix": "IID_"},
-}
-
-
-@lru_cache(maxsize=None)
-def load_com_database(com_type: ComType) -> Dict[str, List[str]]:
-    com_db_path: Path = capa.main.get_default_root() / VALID_COM_TYPES[com_type]["db_path"]
-
-    if not com_db_path.exists():
-        raise IOError(f"COM database path '{com_db_path}' does not exist or cannot be accessed")
-
-    try:
-        with gzip.open(com_db_path, "rb") as gzfile:
-            return json.loads(gzfile.read().decode("utf-8"))
-    except Exception as e:
-        raise IOError(f"Error loading COM database from '{com_db_path}'") from e
-
-
-def translate_com_feature(com_name: str, com_type: ComType) -> ceng.Or:
-    com_db = load_com_database(com_type)
-    guid_strings: Optional[List[str]] = com_db.get(com_name)
-    if guid_strings is None or len(guid_strings) == 0:
-        logger.error(" %s doesn't exist in COM %s database", com_name, com_type)
-        raise InvalidRule(f"'{com_name}' doesn't exist in COM {com_type} database")
-
-    com_features: List = []
-    for guid_string in guid_strings:
-        hex_chars = guid_string.replace("-", "")
-        h = [hex_chars[i : i + 2] for i in range(0, len(hex_chars), 2)]
-        reordered_hex_pairs = [
-            h[3],
-            h[2],
-            h[1],
-            h[0],
-            h[5],
-            h[4],
-            h[7],
-            h[6],
-            h[8],
-            h[9],
-            h[10],
-            h[11],
-            h[12],
-            h[13],
-            h[14],
-            h[15],
-        ]
-        guid_bytes = bytes.fromhex("".join(reordered_hex_pairs))
-        prefix = VALID_COM_TYPES[com_type]["prefix"]
-        com_features.append(capa.features.common.StringFactory(guid_string, f"{prefix+com_name} as GUID string"))
-        com_features.append(capa.features.common.Bytes(guid_bytes, f"{prefix+com_name} as bytes"))
-    return ceng.Or(com_features)
+        types_for_scope = filter(lambda t: isinstance(t, type), SUPPORTED_FEATURES[scope])
+        if not isinstance(feature, tuple(types_for_scope)):  # type: ignore
+            raise InvalidRule(f"feature {feature} not supported for scope {scope}")


 def parse_int(s: str) -> int:
@@ -595,101 +416,53 @@ def pop_statement_description_entry(d):
    return description["description"]


-def trim_dll_part(api: str) -> str:
-    # ordinal imports, like ws2_32.#1, keep dll
-    if ".#" in api:
-        return api
-
-    # kernel32.CreateFileA
-    if api.count(".") == 1:
-        api = api.split(".")[1]
-    return api
-
-
-def build_statements(d, scopes: Scopes):
+def build_statements(d, scope: str):
    if len(d.keys()) > 2:
        raise InvalidRule("too many statements")

    key = list(d.keys())[0]
    description = pop_statement_description_entry(d[key])
    if key == "and":
-        return ceng.And([build_statements(dd, scopes) for dd in d[key]], description=description)
+        return ceng.And([build_statements(dd, scope) for dd in d[key]], description=description)
    elif key == "or":
-        return ceng.Or([build_statements(dd, scopes) for dd in d[key]], description=description)
+        return ceng.Or([build_statements(dd, scope) for dd in d[key]], description=description)
    elif key == "not":
        if len(d[key]) != 1:
            raise InvalidRule("not statement must have exactly one child statement")
-        return ceng.Not(build_statements(d[key][0], scopes), description=description)
+        return ceng.Not(build_statements(d[key][0], scope), description=description)
    elif key.endswith(" or more"):
        count = int(key[: -len("or more")])
-        return ceng.Some(count, [build_statements(dd, scopes) for dd in d[key]], description=description)
+        return ceng.Some(count, [build_statements(dd, scope) for dd in d[key]], description=description)
    elif key == "optional":
        # `optional` is an alias for `0 or more`
        # which is useful for documenting behaviors,
        # like with `write file`, we might say that `WriteFile` is optionally found alongside `CreateFileA`.
-        return ceng.Some(0, [build_statements(dd, scopes) for dd in d[key]], description=description)
-
-    elif key == "process":
-        if Scope.FILE not in scopes:
-            raise InvalidRule("process subscope supported only for file scope")
-
-        if len(d[key]) != 1:
-            raise InvalidRule("subscope must have exactly one child statement")
-
-        return ceng.Subscope(
-            Scope.PROCESS, build_statements(d[key][0], Scopes(dynamic=Scope.PROCESS)), description=description
-        )
-
-    elif key == "thread":
-        if all(s not in scopes for s in (Scope.FILE, Scope.PROCESS)):
-            raise InvalidRule("thread subscope supported only for the process scope")
-
-        if len(d[key]) != 1:
-            raise InvalidRule("subscope must have exactly one child statement")
-
-        return ceng.Subscope(
-            Scope.THREAD, build_statements(d[key][0], Scopes(dynamic=Scope.THREAD)), description=description
-        )
-
-    elif key == "call":
-        if all(s not in scopes for s in (Scope.FILE, Scope.PROCESS, Scope.THREAD)):
-            raise InvalidRule("call subscope supported only for the process and thread scopes")
-
-        if len(d[key]) != 1:
-            raise InvalidRule("subscope must have exactly one child statement")
-
-        return ceng.Subscope(
-            Scope.CALL, build_statements(d[key][0], Scopes(dynamic=Scope.CALL)), description=description
-        )
+        return ceng.Some(0, [build_statements(dd, scope) for dd in d[key]], description=description)

    elif key == "function":
-        if Scope.FILE not in scopes:
+        if scope != FILE_SCOPE:
            raise InvalidRule("function subscope supported only for file scope")

        if len(d[key]) != 1:
            raise InvalidRule("subscope must have exactly one child statement")

-        return ceng.Subscope(
-            Scope.FUNCTION, build_statements(d[key][0], Scopes(static=Scope.FUNCTION)), description=description
-        )
+        return ceng.Subscope(FUNCTION_SCOPE, build_statements(d[key][0], FUNCTION_SCOPE), description=description)

    elif key == "basic block":
-        if Scope.FUNCTION not in scopes:
+        if scope != FUNCTION_SCOPE:
            raise InvalidRule("basic block subscope supported only for function scope")

        if len(d[key]) != 1:
            raise InvalidRule("subscope must have exactly one child statement")

-        return ceng.Subscope(
-            Scope.BASIC_BLOCK, build_statements(d[key][0], Scopes(static=Scope.BASIC_BLOCK)), description=description
-        )
+        return ceng.Subscope(BASIC_BLOCK_SCOPE, build_statements(d[key][0], BASIC_BLOCK_SCOPE), description=description)

    elif key == "instruction":
-        if all(s not in scopes for s in (Scope.FUNCTION, Scope.BASIC_BLOCK)):
+        if scope not in (FUNCTION_SCOPE, BASIC_BLOCK_SCOPE):
            raise InvalidRule("instruction subscope supported only for function and basic block scope")

        if len(d[key]) == 1:
-            statements = build_statements(d[key][0], Scopes(static=Scope.INSTRUCTION))
+            statements = build_statements(d[key][0], INSTRUCTION_SCOPE)
        else:
            # for instruction subscopes, we support a shorthand in which the top level AND is implied.
            # the following are equivalent:
@@ -703,9 +476,9 @@ def build_statements(d, scopes: Scopes):
            #       - arch: i386
            #       - mnemonic: cmp
            #
-            statements = ceng.And([build_statements(dd, Scopes(static=Scope.INSTRUCTION)) for dd in d[key]])
+            statements = ceng.And([build_statements(dd, INSTRUCTION_SCOPE) for dd in d[key]])

-        return ceng.Subscope(Scope.INSTRUCTION, statements, description=description)
+        return ceng.Subscope(INSTRUCTION_SCOPE, statements, description=description)

    elif key.startswith("count(") and key.endswith(")"):
        # e.g.:
@@ -733,10 +506,6 @@ def build_statements(d, scopes: Scopes):
            #     count(number(0x100 = description))
            if term != "string":
                value, description = parse_description(arg, term)
-
-                if term == "api":
-                    value = trim_dll_part(value)
-
                feature = Feature(value, description=description)
            else:
                # arg is string (which doesn't support inline descriptions), like:
@@ -748,7 +517,7 @@ def build_statements(d, scopes: Scopes):
                feature = Feature(arg)
        else:
            feature = Feature()
-        ensure_feature_valid_for_scopes(scopes, feature)
+        ensure_feature_valid_for_scope(scope, feature)

        count = d[key]
        if isinstance(count, int):
@@ -782,7 +551,7 @@ def build_statements(d, scopes: Scopes):
            feature = capa.features.insn.OperandNumber(index, value, description=description)
        except ValueError as e:
            raise InvalidRule(str(e)) from e
-        ensure_feature_valid_for_scopes(scopes, feature)
+        ensure_feature_valid_for_scope(scope, feature)
        return feature

    elif key.startswith("operand[") and key.endswith("].offset"):
@@ -798,7 +567,7 @@ def build_statements(d, scopes: Scopes):
            feature = capa.features.insn.OperandOffset(index, value, description=description)
        except ValueError as e:
            raise InvalidRule(str(e)) from e
-        ensure_feature_valid_for_scopes(scopes, feature)
+        ensure_feature_valid_for_scope(scope, feature)
        return feature

    elif (
@@ -818,28 +587,17 @@ def build_statements(d, scopes: Scopes):
            feature = capa.features.insn.Property(value, access=access, description=description)
        except ValueError as e:
            raise InvalidRule(str(e)) from e
-        ensure_feature_valid_for_scopes(scopes, feature)
+        ensure_feature_valid_for_scope(scope, feature)
        return feature

-    elif key.startswith("com/"):
-        com_type = str(key[len("com/") :]).upper()
-        if com_type not in [item.name for item in ComType]:
-            raise InvalidRule(f"unexpected COM type: {com_type}")
-        value, description = parse_description(d[key], key, d.get("description"))
-        return translate_com_feature(value, ComType[com_type])
-
    else:
        Feature = parse_feature(key)
        value, description = parse_description(d[key], key, d.get("description"))
-
-        if key == "api":
-            value = trim_dll_part(value)
-
        try:
            feature = Feature(value, description=description)
        except ValueError as e:
            raise InvalidRule(str(e)) from e
-        ensure_feature_valid_for_scopes(scopes, feature)
+        ensure_feature_valid_for_scope(scope, feature)
        return feature


@@ -852,10 +610,10 @@ def second(s: List[Any]) -> Any:


 class Rule:
-    def __init__(self, name: str, scopes: Scopes, statement: Statement, meta, definition=""):
+    def __init__(self, name: str, scope: str, statement: Statement, meta, definition=""):
        super().__init__()
        self.name = name
-        self.scopes = scopes
+        self.scope = scope
        self.statement = statement
        self.meta = meta
        self.definition = definition
@@ -864,7 +622,7 @@ class Rule:
        return f"Rule(name={self.name})"

    def __repr__(self):
-        return f"Rule(scope={self.scopes}, name={self.name})"
+        return f"Rule(scope={self.scope}, name={self.name})"

    def get_dependencies(self, namespaces):
        """
@@ -922,19 +680,13 @@ class Rule:
                # the name is a randomly generated, hopefully unique value.
                # ideally, this won't every be rendered to a user.
                name = self.name + "/" + uuid.uuid4().hex
-                if subscope.scope in STATIC_SCOPES:
-                    scopes = Scopes(static=subscope.scope)
-                elif subscope.scope in DYNAMIC_SCOPES:
-                    scopes = Scopes(dynamic=subscope.scope)
-                else:
-                    raise InvalidRule(f"scope {subscope.scope} is not a valid subscope")
                new_rule = Rule(
                    name,
-                    scopes,
+                    subscope.scope,
                    subscope.child,
                    {
                        "name": name,
-                        "scopes": asdict(scopes),
+                        "scope": subscope.scope,
                        # these derived rules are never meant to be inspected separately,
                        # they are dependencies for the parent rule,
                        # so mark it as such.
@@ -959,9 +711,6 @@ class Rule:
            for child in statement.get_children():
                yield from self._extract_subscope_rules_rec(child)

-    def is_file_limitation_rule(self) -> bool:
-        return self.meta.get("namespace", "") == "internal/limitation/file"
-
    def is_subscope_rule(self):
        return bool(self.meta.get("capa/subscope-rule", False))

@@ -988,33 +737,6 @@ class Rule:

        yield from self._extract_subscope_rules_rec(self.statement)

-    def _extract_all_features_rec(self, statement) -> Set[Feature]:
-        feature_set: Set[Feature] = set()
-
-        for child in statement.get_children():
-            if isinstance(child, Statement):
-                feature_set.update(self._extract_all_features_rec(child))
-            else:
-                feature_set.add(child)
-        return feature_set
-
-    def extract_all_features(self) -> Set[Feature]:
-        """
-        recursively extracts all feature statements in this rule.
-
-        returns:
-            set: A set of all feature statements contained within this rule.
-        """
-        if not isinstance(self.statement, ceng.Statement):
-            # For rules with single feature like
-            # anti-analysis\obfuscation\obfuscated-with-advobfuscator.yml
-            # contains a single feature - substring , which is of type String
-            return {
-                self.statement,
-            }
-
-        return self._extract_all_features_rec(self.statement)
-
    def evaluate(self, features: FeatureSet, short_circuit=True):
        capa.perf.counters["evaluate.feature"] += 1
        capa.perf.counters["evaluate.feature.rule"] += 1
@@ -1024,21 +746,9 @@ class Rule:
    def from_dict(cls, d: Dict[str, Any], definition: str) -> "Rule":
        meta = d["rule"]["meta"]
        name = meta["name"]
-
        # if scope is not specified, default to function scope.
        # this is probably the mode that rule authors will start with.
-        # each rule has two scopes, a static-flavor scope, and a
-        # dynamic-flavor one. which one is used depends on the analysis type.
-        if "scope" in meta:
-            raise InvalidRule(f"legacy rule detected (rule.meta.scope), please update to the new syntax: {name}")
-        elif "scopes" in meta:
-            scopes_ = meta.get("scopes")
-        else:
-            raise InvalidRule("please specify at least one of this rule's (static/dynamic) scopes")
-        if not isinstance(scopes_, dict):
-            raise InvalidRule("the scopes field must contain a dictionary specifying the scopes")
-
-        scopes: Scopes = Scopes.from_dict(scopes_)
+        scope = meta.get("scope", FUNCTION_SCOPE)
        statements = d["rule"]["features"]

        # the rule must start with a single logic node.
@@ -1049,13 +759,16 @@ class Rule:
        if isinstance(statements[0], ceng.Subscope):
            raise InvalidRule("top level statement may not be a subscope")

+        if scope not in SUPPORTED_FEATURES.keys():
+            raise InvalidRule("{:s} is not a supported scope".format(scope))
+
        meta = d["rule"]["meta"]
        if not isinstance(meta.get("att&ck", []), list):
            raise InvalidRule("ATT&CK mapping must be a list")
        if not isinstance(meta.get("mbc", []), list):
            raise InvalidRule("MBC mapping must be a list")

-        return cls(name, scopes, build_statements(statements[0], scopes), meta, definition)
+        return cls(name, scope, build_statements(statements[0], scope), meta, definition)

    @staticmethod
    @lru_cache()
@@ -1083,7 +796,7 @@ class Rule:

        # leave quotes unchanged.
        # manually verified this property exists, even if mypy complains.
-        y.preserve_quotes = True
+        y.preserve_quotes = True  # type: ignore

        # indent lists by two spaces below their parent
        #
@@ -1095,7 +808,7 @@ class Rule:

        # avoid word wrapping
        # manually verified this property exists, even if mypy complains.
-        y.width = 4096
+        y.width = 4096  # type: ignore

        return y

@@ -1154,8 +867,10 @@ class Rule:
                del meta[k]
        for k, v in self.meta.items():
            meta[k] = v
+
        # the name and scope of the rule instance overrides anything in meta.
        meta["name"] = self.name
+        meta["scope"] = self.scope

        def move_to_end(m, k):
            # ruamel.yaml uses an ordereddict-like structure to track maps (CommentedMap).
@@ -1176,6 +891,7 @@ class Rule:
            if key in META_KEYS:
                continue
            move_to_end(meta, key)
+
        # save off the existing hidden meta values,
        # emit the document,
        # and re-add the hidden meta.
@@ -1230,11 +946,12 @@ class Rule:
        return doc


-def get_rules_with_scope(rules, scope: Scope) -> List[Rule]:
+def get_rules_with_scope(rules, scope) -> List[Rule]:
    """
    from the given collection of rules, select those with the given scope.
+    `scope` is one of the capa.rules.*_SCOPE constants.
    """
-    return [rule for rule in rules if scope in rule.scopes]
+    return [rule for rule in rules if rule.scope == scope]


 def get_rules_and_dependencies(rules: List[Rule], rule_name: str) -> Iterator[Rule]:
@@ -1359,10 +1076,7 @@ class RuleSet:
        capa.engine.match(ruleset.file_rules, ...)
    """

-    def __init__(
-        self,
-        rules: List[Rule],
-    ):
+    def __init__(self, rules: List[Rule]):
        super().__init__()

        ensure_rules_are_unique(rules)
@@ -1384,23 +1098,15 @@ class RuleSet:

        rules = capa.optimizer.optimize_rules(rules)

-        self.file_rules = self._get_rules_for_scope(rules, Scope.FILE)
-        self.process_rules = self._get_rules_for_scope(rules, Scope.PROCESS)
-        self.thread_rules = self._get_rules_for_scope(rules, Scope.THREAD)
-        self.call_rules = self._get_rules_for_scope(rules, Scope.CALL)
-        self.function_rules = self._get_rules_for_scope(rules, Scope.FUNCTION)
-        self.basic_block_rules = self._get_rules_for_scope(rules, Scope.BASIC_BLOCK)
-        self.instruction_rules = self._get_rules_for_scope(rules, Scope.INSTRUCTION)
+        self.file_rules = self._get_rules_for_scope(rules, FILE_SCOPE)
+        self.function_rules = self._get_rules_for_scope(rules, FUNCTION_SCOPE)
+        self.basic_block_rules = self._get_rules_for_scope(rules, BASIC_BLOCK_SCOPE)
+        self.instruction_rules = self._get_rules_for_scope(rules, INSTRUCTION_SCOPE)
        self.rules = {rule.name: rule for rule in rules}
        self.rules_by_namespace = index_rules_by_namespace(rules)

        # unstable
        (self._easy_file_rules_by_feature, self._hard_file_rules) = self._index_rules_by_feature(self.file_rules)
-        (self._easy_process_rules_by_feature, self._hard_process_rules) = self._index_rules_by_feature(
-            self.process_rules
-        )
-        (self._easy_thread_rules_by_feature, self._hard_thread_rules) = self._index_rules_by_feature(self.thread_rules)
-        (self._easy_call_rules_by_feature, self._hard_call_rules) = self._index_rules_by_feature(self.call_rules)
        (self._easy_function_rules_by_feature, self._hard_function_rules) = self._index_rules_by_feature(
            self.function_rules
        )
@@ -1646,25 +1352,16 @@ class RuleSet:
        except that it may be more performant.
        """
        easy_rules_by_feature = {}
-        if scope == Scope.FILE:
+        if scope is Scope.FILE:
            easy_rules_by_feature = self._easy_file_rules_by_feature
            hard_rule_names = self._hard_file_rules
-        elif scope == Scope.PROCESS:
-            easy_rules_by_feature = self._easy_process_rules_by_feature
-            hard_rule_names = self._hard_process_rules
-        elif scope == Scope.THREAD:
-            easy_rules_by_feature = self._easy_thread_rules_by_feature
-            hard_rule_names = self._hard_thread_rules
-        elif scope == Scope.CALL:
-            easy_rules_by_feature = self._easy_call_rules_by_feature
-            hard_rule_names = self._hard_call_rules
-        elif scope == Scope.FUNCTION:
+        elif scope is Scope.FUNCTION:
            easy_rules_by_feature = self._easy_function_rules_by_feature
            hard_rule_names = self._hard_function_rules
-        elif scope == Scope.BASIC_BLOCK:
+        elif scope is Scope.BASIC_BLOCK:
            easy_rules_by_feature = self._easy_basic_block_rules_by_feature
            hard_rule_names = self._hard_basic_block_rules
-        elif scope == Scope.INSTRUCTION:
+        elif scope is Scope.INSTRUCTION:
            easy_rules_by_feature = self._easy_instruction_rules_by_feature
            hard_rule_names = self._hard_instruction_rules
        else:
--- a/capa/version.py
+++ b/capa/version.py
@@ -5,7 +5,7 @@
 # Unless required by applicable law or agreed to in writing, software distributed under the License
 #  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and limitations under the License.
-__version__ = "6.1.0"
+__version__ = "6.0.0"


 def get_major_version():
--- a/doc/capa_quickstart.pdf
+++ b/doc/capa_quickstart.pdf
--- a/doc/img/ghidra_backend_logo.png
+++ b/doc/img/ghidra_backend_logo.png
--- a/doc/img/ghidra_script_mngr_output.png
+++ b/doc/img/ghidra_script_mngr_output.png
--- a/doc/img/ghidra_script_mngr_rules.png
+++ b/doc/img/ghidra_script_mngr_rules.png
--- a/doc/img/ghidra_script_mngr_verbosity.png
+++ b/doc/img/ghidra_script_mngr_verbosity.png
--- a/doc/installation.md
+++ b/doc/installation.md
@@ -105,28 +105,27 @@ To install these development dependencies, run:

 We use [pre-commit](https://pre-commit.com/) so that its trivial to run the same linters & configuration locally as in CI.

-Run all linters like:
+Run all linters liks:

-    ❯ pre-commit run --hook-stage=manual --all-files
+    ❯ pre-commit run --all-files
    isort....................................................................Passed
    black....................................................................Passed
    ruff.....................................................................Passed
    flake8...................................................................Passed
    mypy.....................................................................Passed
-    pytest (fast)............................................................Passed

 Or run a single linter like:

-    ❯ pre-commit run --all-files --hook-stage=manual isort
+    ❯ pre-commit run --all-files isort
    isort....................................................................Passed


 Importantly, you can configure pre-commit to run automatically before every commit by running:

-    ❯ pre-commit install --hook-type=pre-commit
+    ❯ pre-commit install --hook-type pre-commit
    pre-commit installed at .git/hooks/pre-commit

-    ❯ pre-commit install --hook-type=pre-push
+    ❯ pre-commit install --hook-type pre-push
    pre-commit installed at .git/hooks/pre-push

 This way you can ensure that you don't commit code style or formatting offenses.
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -32,25 +32,24 @@ classifiers = [
    "Topic :: Security",
 ]
 dependencies = [
-    "tqdm==4.66.1",
-    "pyyaml==6.0.1",
+    "tqdm==4.65.0",
+    "pyyaml==6.0",
    "tabulate==0.9.0",
    "colorama==0.4.6",
    "termcolor==2.3.0",
-    "wcwidth==0.2.12",
+    "wcwidth==0.2.6",
    "ida-settings==2.1.0",
    "viv-utils[flirt]==0.7.9",
    "halo==0.0.31",
    "networkx==3.1",
-    "ruamel.yaml==0.18.5",
+    "ruamel.yaml==0.17.32",
    "vivisect==1.1.1",
    "pefile==2023.2.7",
-    "pyelftools==0.30",
-    "dnfile==0.14.1",
+    "pyelftools==0.29",
+    "dnfile==0.13.0",
    "dncil==1.0.2",
-    "pydantic==2.4.0",
+    "pydantic==1.10.9",
    "protobuf==4.23.4",
-    "dexparser==1.2.0",
 ]
 dynamic = ["version"]

@@ -62,44 +61,44 @@ packages = ["capa"]

 [project.optional-dependencies]
 dev = [
-    "pre-commit==3.5.0",
-    "pytest==7.4.3",
+    "pre-commit==3.3.3",
+    "pytest==7.4.0",
    "pytest-sugar==0.9.7",
    "pytest-instafail==0.5.0",
    "pytest-cov==4.1.0",
-    "flake8==6.1.0",
-    "flake8-bugbear==23.11.26",
-    "flake8-encodings==0.5.1",
+    "flake8==6.0.0",
+    "flake8-bugbear==23.7.10",
+    "flake8-encodings==0.5.0.post1",
    "flake8-comprehensions==3.14.0",
    "flake8-logging-format==0.9.0",
-    "flake8-no-implicit-concat==0.3.5",
+    "flake8-no-implicit-concat==0.3.4",
    "flake8-print==5.0.0",
    "flake8-todos==0.3.0",
-    "flake8-simplify==0.21.0",
+    "flake8-simplify==0.20.0",
    "flake8-use-pathlib==0.3.0",
    "flake8-copyright==0.2.4",
-    "ruff==0.1.6",
-    "black==23.11.0",
+    "ruff==0.0.278",
+    "black==23.7.0",
    "isort==5.11.4",
-    "mypy==1.7.1",
+    "mypy==1.4.1",
    "psutil==5.9.2",
    "stix2==3.0.1",
    "requests==2.31.0",
-    "mypy-protobuf==3.5.0",
+    "mypy-protobuf==3.4.0",
    # type stubs for mypy
    "types-backports==0.1.3",
    "types-colorama==0.4.15.11",
    "types-PyYAML==6.0.8",
-    "types-tabulate==0.9.0.3",
+    "types-tabulate==0.9.0.1",
    "types-termcolor==1.1.4",
    "types-psutil==5.8.23",
-    "types_requests==2.31.0.10",
-    "types-protobuf==4.23.0.3",
+    "types_requests==2.31.0.1",
+    "types-protobuf==4.23.0.1",
 ]
 build = [
-    "pyinstaller==6.2.0",
-    "setuptools==69.0.2",
-    "build==1.0.3"
+    "pyinstaller==5.10.1",
+    "setuptools==68.0.0",
+    "build==0.10.0"
 ]

 [project.urls]
--- a/2
+++ b/2
--- a/scripts/bulk-process.py
+++ b/scripts/bulk-process.py
@@ -75,7 +75,6 @@ import capa
 import capa.main
 import capa.rules
 import capa.render.json
-import capa.capabilities.common
 import capa.render.result_document as rd
 from capa.features.common import OS_AUTO

@@ -113,7 +112,7 @@ def get_capa_results(args):
        extractor = capa.main.get_extractor(
            path, format, os_, capa.main.BACKEND_VIV, sigpaths, should_save_workspace, disable_progress=True
        )
-    except capa.exceptions.UnsupportedFormatError:
+    except capa.main.UnsupportedFormatError:
        # i'm 100% sure if multiprocessing will reliably raise exceptions across process boundaries.
        # so instead, return an object with explicit success/failure status.
        #
@@ -124,7 +123,7 @@ def get_capa_results(args):
            "status": "error",
            "error": f"input file does not appear to be a PE file: {path}",
        }
-    except capa.exceptions.UnsupportedRuntimeError:
+    except capa.main.UnsupportedRuntimeError:
        return {
            "path": path,
            "status": "error",
@@ -137,13 +136,16 @@ def get_capa_results(args):
            "error": f"unexpected error: {e}",
        }

-    capabilities, counts = capa.capabilities.common.find_capabilities(rules, extractor, disable_progress=True)
+    meta = capa.main.collect_metadata([], path, format, os_, [], extractor)
+    capabilities, counts = capa.main.find_capabilities(rules, extractor, disable_progress=True)

-    meta = capa.main.collect_metadata([], path, format, os_, [], extractor, counts)
+    meta.analysis.feature_counts = counts["feature_counts"]
+    meta.analysis.library_functions = counts["library_functions"]
    meta.analysis.layout = capa.main.compute_layout(rules, extractor, capabilities)

    doc = rd.ResultDocument.from_capa(meta, rules, capabilities)
-    return {"path": path, "status": "ok", "ok": doc.model_dump()}
+
+    return {"path": path, "status": "ok", "ok": doc.dict(exclude_none=True)}


 def main(argv=None):
@@ -212,9 +214,7 @@ def main(argv=None):
            if result["status"] == "error":
                logger.warning(result["error"])
            elif result["status"] == "ok":
-                results[result["path"].as_posix()] = rd.ResultDocument.model_validate(result["ok"]).model_dump_json(
-                    exclude_none=True
-                )
+                results[result["path"].as_posix()] = rd.ResultDocument.parse_obj(result["ok"]).json(exclude_none=True)
            else:
                raise ValueError(f"unexpected status: {result['status']}")

--- a/scripts/capa2yara.py
+++ b/scripts/capa2yara.py
@@ -566,7 +566,7 @@ def convert_rules(rules, namespaces, cround, make_priv):
            logger.info("skipping already converted rule capa: %s - yara rule: %s", rule.name, rule_name)
            continue

-        logger.info("-------------------------- DOING RULE CAPA: %s - yara rule: %s", rule.name, rule_name)
+        logger.info("-------------------------- DOING RULE CAPA: %s - yara rule: ", rule.name, rule_name)
        if "capa/path" in rule.meta:
            url = get_rule_url(rule.meta["capa/path"])
        else:
@@ -603,12 +603,7 @@ def convert_rules(rules, namespaces, cround, make_priv):
                meta_name = meta
                # e.g. 'examples:' can be a list
                seen_hashes = []
-                if isinstance(metas[meta], dict):
-                    if meta_name == "scopes":
-                        yara_meta += "\t" + "static scope" + ' = "' + metas[meta]["static"] + '"\n'
-                        yara_meta += "\t" + "dynamic scope" + ' = "' + metas[meta]["dynamic"] + '"\n'
-
-                elif isinstance(metas[meta], list):
+                if isinstance(metas[meta], list):
                    if meta_name == "examples":
                        meta_name = "hash"
                    if meta_name == "att&ck":
--- a/scripts/capa_as_library.py
+++ b/scripts/capa_as_library.py
@@ -19,7 +19,6 @@ import capa.features
 import capa.render.json
 import capa.render.utils as rutils
 import capa.render.default
-import capa.capabilities.common
 import capa.render.result_document as rd
 import capa.features.freeze.features as frzf
 from capa.features.common import OS_AUTO, FORMAT_AUTO
@@ -176,10 +175,13 @@ def capa_details(rules_path: Path, file_path: Path, output_format="dictionary"):
    extractor = capa.main.get_extractor(
        file_path, FORMAT_AUTO, OS_AUTO, capa.main.BACKEND_VIV, [], False, disable_progress=True
    )
-    capabilities, counts = capa.capabilities.common.find_capabilities(rules, extractor, disable_progress=True)
+    capabilities, counts = capa.main.find_capabilities(rules, extractor, disable_progress=True)

    # collect metadata (used only to make rendering more complete)
-    meta = capa.main.collect_metadata([], file_path, FORMAT_AUTO, OS_AUTO, [rules_path], extractor, counts)
+    meta = capa.main.collect_metadata([], file_path, FORMAT_AUTO, OS_AUTO, [rules_path], extractor)
+
+    meta.analysis.feature_counts = counts["feature_counts"]
+    meta.analysis.library_functions = counts["library_functions"]
    meta.analysis.layout = capa.main.compute_layout(rules, extractor, capabilities)

    capa_output: Any = False
--- a/scripts/detect_duplicate_features.py
+++ b/scripts/detect_duplicate_features.py
@@ -8,17 +8,38 @@
 import sys
 import logging
 import argparse
-from typing import Set
 from pathlib import Path

 import capa.main
 import capa.rules
-from capa.features.common import Feature
+import capa.engine as ceng

 logger = logging.getLogger("detect_duplicate_features")


-def get_features(rule_path: str) -> Set[Feature]:
+def get_child_features(feature: ceng.Statement) -> list:
+    """
+    Recursively extracts all feature statements from a given rule statement.
+
+    Args:
+        feature (capa.engine.Statement): The feature statement to extract features from.
+
+    Returns:
+        list: A list of all feature statements contained within the given feature statement.
+    """
+    children = []
+
+    if isinstance(feature, (ceng.And, ceng.Or, ceng.Some)):
+        for child in feature.children:
+            children.extend(get_child_features(child))
+    elif isinstance(feature, (ceng.Subscope, ceng.Range, ceng.Not)):
+        children.extend(get_child_features(feature.child))
+    else:
+        children.append(feature)
+    return children
+
+
+def get_features(rule_path: str) -> list:
    """
    Extracts all features from a given rule file.

@@ -26,15 +47,17 @@ def get_features(rule_path: str) -> Set[Feature]:
        rule_path (str): The path to the rule file to extract features from.

    Returns:
-        set: A set of all feature statements contained within the rule file.
+        list: A list of all feature statements contained within the rule file.
    """
+    feature_list = []
    with Path(rule_path).open("r", encoding="utf-8") as f:
        try:
            new_rule = capa.rules.Rule.from_yaml(f.read())
-            return new_rule.extract_all_features()
+            feature_list = get_child_features(new_rule.statement)
        except Exception as e:
            logger.error("Error: New rule %s %s %s", rule_path, str(type(e)), str(e))
            sys.exit(-1)
+    return feature_list


 def find_overlapping_rules(new_rule_path, rules_path):
@@ -44,6 +67,7 @@ def find_overlapping_rules(new_rule_path, rules_path):

    # Loads features of new rule in a list.
    new_rule_features = get_features(new_rule_path)
+
    count = 0
    overlapping_rules = []

@@ -51,7 +75,7 @@ def find_overlapping_rules(new_rule_path, rules_path):
    ruleset = capa.main.get_rules(rules_path)

    for rule_name, rule in ruleset.rules.items():
-        rule_features = rule.extract_all_features()
+        rule_features = get_child_features(rule.statement)

        if not len(rule_features):
            continue
--- a/scripts/import-to-ida.py
+++ b/scripts/import-to-ida.py
@@ -30,7 +30,6 @@ See the License for the specific language governing permissions and limitations
 """
 import logging
 import binascii
-from pathlib import Path

 import ida_nalt
 import ida_funcs
@@ -69,7 +68,7 @@ def main():
    if not path:
        return 0

-    result_doc = capa.render.result_document.ResultDocument.from_file(Path(path))
+    result_doc = capa.render.result_document.ResultDocument.parse_file(path)
    meta, capabilities = result_doc.to_capa()

    # in IDA 7.4, the MD5 hash may be truncated, for example:
@@ -90,7 +89,7 @@ def main():
            continue
        if rule.meta.is_subscope_rule:
            continue
-        if rule.meta.scopes.static == capa.rules.Scope.FUNCTION:
+        if rule.meta.scope != capa.rules.Scope.FUNCTION:
            continue

        ns = rule.meta.namespace
--- a/scripts/lint.py
+++ b/scripts/lint.py
@@ -41,7 +41,6 @@ import capa.rules
 import capa.engine
 import capa.helpers
 import capa.features.insn
-import capa.capabilities.common
 from capa.rules import Rule, RuleSet
 from capa.features.common import OS_AUTO, String, Feature, Substring
 from capa.render.result_document import RuleMetadata
@@ -152,74 +151,20 @@ class NamespaceDoesntMatchRulePath(Lint):
        return rule.meta["namespace"] not in get_normpath(rule.meta["capa/path"])


-class MissingScopes(Lint):
-    name = "missing scopes"
-    recommendation = (
-        "Add meta.scopes with both the static (meta.scopes.static) and dynamic (meta.scopes.dynamic) scopes"
-    )
+class MissingScope(Lint):
+    name = "missing scope"
+    recommendation = "Add meta.scope so that the scope is explicit (defaults to `function`)"

    def check_rule(self, ctx: Context, rule: Rule):
-        return "scopes" not in rule.meta
+        return "scope" not in rule.meta


-class MissingStaticScope(Lint):
-    name = "missing static scope"
-    recommendation = (
-        "Add a static scope for the rule (file, function, basic block, instruction, or unspecified/unsupported)"
-    )
+class InvalidScope(Lint):
+    name = "invalid scope"
+    recommendation = "Use only file, function, basic block, or instruction rule scopes"

    def check_rule(self, ctx: Context, rule: Rule):
-        return "static" not in rule.meta.get("scopes")
-
-
-class MissingDynamicScope(Lint):
-    name = "missing dynamic scope"
-    recommendation = "Add a dynamic scope for the rule (file, process, thread, call, or unspecified/unsupported)"
-
-    def check_rule(self, ctx: Context, rule: Rule):
-        return "dynamic" not in rule.meta.get("scopes")
-
-
-class InvalidStaticScope(Lint):
-    name = "invalid static scope"
-    recommendation = (
-        "For the static scope, use either: file, function, basic block, instruction, or unspecified/unsupported"
-    )
-
-    def check_rule(self, ctx: Context, rule: Rule):
-        return rule.meta.get("scopes").get("static") not in (
-            "file",
-            "function",
-            "basic block",
-            "instruction",
-            "unspecified",
-            "unsupported",
-        )
-
-
-class InvalidDynamicScope(Lint):
-    name = "invalid static scope"
-    recommendation = "For the dynamic scope, use either: file, process, thread, call, or unspecified/unsupported"
-
-    def check_rule(self, ctx: Context, rule: Rule):
-        return rule.meta.get("scopes").get("dynamic") not in (
-            "file",
-            "process",
-            "thread",
-            "call",
-            "unspecified",
-            "unsupported",
-        )
-
-
-class InvalidScopes(Lint):
-    name = "invalid scopes"
-    recommendation = "At least one scope (static or dynamic) must be specified"
-
-    def check_rule(self, ctx: Context, rule: Rule):
-        return (rule.meta.get("scopes").get("static") in ("unspecified", "unsupported")) and (
-            rule.meta.get("scopes").get("dynamic") in ("unspecified", "unsupported")
-        )
+        return rule.meta.get("scope") not in ("file", "function", "basic block", "instruction")


 class MissingAuthors(Lint):
@@ -360,14 +305,14 @@ def get_sample_capabilities(ctx: Context, path: Path) -> Set[str]:
    elif nice_path.name.endswith(capa.helpers.EXTENSIONS_SHELLCODE_64):
        format_ = "sc64"
    else:
-        format_ = capa.helpers.get_auto_format(nice_path)
+        format_ = capa.main.get_auto_format(nice_path)

    logger.debug("analyzing sample: %s", nice_path)
    extractor = capa.main.get_extractor(
-        nice_path, format_, OS_AUTO, capa.main.BACKEND_VIV, DEFAULT_SIGNATURES, False, disable_progress=True
+        nice_path, format_, OS_AUTO, "", DEFAULT_SIGNATURES, False, disable_progress=True
    )

-    capabilities, _ = capa.capabilities.common.find_capabilities(ctx.rules, extractor, disable_progress=True)
+    capabilities, _ = capa.main.find_capabilities(ctx.rules, extractor, disable_progress=True)
    # mypy doesn't seem to be happy with the MatchResults type alias & set(...keys())?
    # so we ignore a few types here.
    capabilities = set(capabilities.keys())  # type: ignore
@@ -624,10 +569,6 @@ class FeatureNtdllNtoskrnlApi(Lint):
                    "ZwCreateProcess",
                    "ZwCreateUserProcess",
                    "RtlCreateUserProcess",
-                    "NtProtectVirtualMemory",
-                    "NtEnumerateSystemEnvironmentValuesEx",
-                    "NtQuerySystemEnvironmentValueEx",
-                    "NtQuerySystemEnvironmentValue",
                ):
                    # ntoskrnl.exe does not export these routines
                    continue
@@ -638,7 +579,6 @@ class FeatureNtdllNtoskrnlApi(Lint):
                    "KeStackAttachProcess",
                    "ObfDereferenceObject",
                    "KeUnstackDetachProcess",
-                    "ExGetFirmwareEnvironmentVariable",
                ):
                    # ntdll.dll does not export these routines
                    continue
@@ -755,18 +695,14 @@ def lint_name(ctx: Context, rule: Rule):
    return run_lints(NAME_LINTS, ctx, rule)


-SCOPES_LINTS = (
-    MissingScopes(),
-    MissingStaticScope(),
-    MissingDynamicScope(),
-    InvalidStaticScope(),
-    InvalidDynamicScope(),
-    InvalidScopes(),
+SCOPE_LINTS = (
+    MissingScope(),
+    InvalidScope(),
 )


 def lint_scope(ctx: Context, rule: Rule):
-    return run_lints(SCOPES_LINTS, ctx, rule)
+    return run_lints(SCOPE_LINTS, ctx, rule)


 META_LINTS = (
--- a/scripts/profile-time.py
+++ b/scripts/profile-time.py
@@ -54,7 +54,6 @@ import capa.helpers
 import capa.features
 import capa.features.common
 import capa.features.freeze
-import capa.capabilities.common

 logger = logging.getLogger("capa.profile")

@@ -115,7 +114,7 @@ def main(argv=None):

        def do_iteration():
            capa.perf.reset()
-            capa.capabilities.common.find_capabilities(rules, extractor, disable_progress=True)
+            capa.main.find_capabilities(rules, extractor, disable_progress=True)
            pbar.update(1)

        samples = timeit.repeat(do_iteration, number=args.number, repeat=args.repeat)
--- a/scripts/proto-from-results.py
+++ b/scripts/proto-from-results.py
@@ -31,7 +31,6 @@ Example:
 import sys
 import logging
 import argparse
-from pathlib import Path

 import capa.render.proto
 import capa.render.result_document
@@ -65,7 +64,7 @@ def main(argv=None):
        logging.basicConfig(level=logging.INFO)
        logging.getLogger().setLevel(logging.INFO)

-    rd = capa.render.result_document.ResultDocument.from_file(Path(args.json))
+    rd = capa.render.result_document.ResultDocument.parse_file(args.json)
    pb = capa.render.proto.doc_to_pb2(rd)

    sys.stdout.buffer.write(pb.SerializeToString(deterministic=True))
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Willi Ballenthin	4b48b2354a	show-mdmp: print complete memory map when its available	2023-07-19 17:12:14 +02:00
Willi Ballenthin	166f83e214	show-mdmp: add 64-bit support	2023-07-19 16:45:20 +02:00
Willi Ballenthin	0bb163e4bb	scripts: add script to show layout of minidump file	2023-07-19 15:41:29 +02:00