#!/usr/bin/env python2 """ show the features extracted by capa. """ import sys import logging import argparse import capa.main import capa.rules import capa.engine import capa.features import capa.features.freeze import capa.features.extractors.viv def main(argv=None): if argv is None: argv = sys.argv[1:] formats = [ ("auto", "(default) detect file type automatically"), ("pe", "Windows PE file"), ("sc32", "32-bit shellcode"), ("sc64", "64-bit shellcode"), ("freeze", "features previously frozen by capa"), ] format_help = ", ".join(["%s: %s" % (f[0], f[1]) for f in formats]) parser = argparse.ArgumentParser(description="detect capabilities in programs.") parser.add_argument("sample", type=str, help="Path to sample to analyze") parser.add_argument( "-f", "--format", choices=[f[0] for f in formats], default="auto", help="Select sample format, %s" % format_help ) parser.add_argument("-F", "--function", type=lambda x: int(x, 0), help="Show features for specific function") args = parser.parse_args(args=argv) logging.basicConfig(level=logging.INFO) logging.getLogger().setLevel(logging.INFO) if args.format == "freeze": with open(args.sample, "rb") as f: extractor = capa.features.freeze.load(f.read()) else: vw = capa.main.get_workspace(args.sample, args.format) extractor = capa.features.extractors.viv.VivisectFeatureExtractor(vw, args.sample) if not args.function: for feature, va in extractor.extract_file_features(): if va: print("file: 0x%08x: %s" % (va, feature)) else: print("file: 0x00000000: %s" % (feature)) functions = extractor.get_functions() if args.function: if args.format == "freeze": functions = filter(lambda f: f == args.function, functions) else: functions = filter(lambda f: f.va == args.function, functions) for f in functions: for feature, va in extractor.extract_function_features(f): print("func: 0x%08x: %s" % (va, feature)) for bb in extractor.get_basic_blocks(f): for feature, va in extractor.extract_basic_block_features(f, bb): print("bb : 0x%08x: %s" % (va, feature)) for insn in extractor.get_instructions(f, bb): for feature, va in extractor.extract_insn_features(f, bb, insn): print("insn: 0x%08x: %s" % (va, feature)) return 0 if __name__ == "__main__": sys.exit(main())