16eae70c17
* explorer web: improve url navigation This commit enhances the navigation guard for the /analysis route to provide a better user experience when loading data from a URL: Previously: users browsing to /analysis were always redirected to the homepage (/). With this commit: - If a user accesses /analysis without an rdoc parameter, they are still redirected to the homepage. - If a user accesses /analysis with an rdoc parameter, the following occurs: The user is redirected to the homepage (/) and the rdoc parameter is preserved in the URL, capa Explorer Web then loads the rdoc from URL. --------- Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
capa Explorer Web
capa Explorer Web is a browser-based user interface for exploring program capabilities identified by capa. It provides an intuitive and interactive way to analyze and visualize the results of capa analysis.
Features
- Import capa Results: Easily upload or import capa JSON result files.
- Interactive Tree View: Explore and filter rule matches in a hierarchical structure.
- Function Capabilities: Group and filter capabilities by function for static analysis.
- Process Capabilities: Group capabilities by process for dynamic analysis.
Getting Started
-
Access the application: Open capa Explorer Web in your web browser. You can start using capa Explorer Web by accessing https://mandiant.github.io/capa or running it locally by downloading the offline release from the top right-hand corner and opening it in your web browser.
-
Import capa results:
- Click on "Upload from local" to select a capa analysis document file from your computer (with a version higher than 7.0.0).
- You can generate the analysis document by running
capa.exe -j results.json sample.exe_
- You can generate the analysis document by running
- Or, paste a URL to a capa JSON file and click the arrow button to load it.
- Like for the other import mechanisms, loading of both plain (
.json) and GZIP compressed JSON (.json.gz) files is supported).
- Like for the other import mechanisms, loading of both plain (
- Alternatively, use the "Preview Static" or "Preview Dynamic" for sample data.
- Click on "Upload from local" to select a capa analysis document file from your computer (with a version higher than 7.0.0).
-
Explore the results:
- Use the tree view to navigate through the identified capabilities.
- Toggle between different views using the checkboxes in the settings panel:
- "Show capabilities by function/process" for grouped analysis.
- "Show distinct library rule matches" to include or exclude library rules.
- "Show columns filters" to show per-column search filters.
-
Interact with the results:
- Expand/collapse nodes in the table to see more details by clicking rows or clicking arrow icons.
- Use the search and filter options to find specific features, functions or capabilities (rules).
- Right click on rule names (and
matchnodes) to view their source code or additional information.
Feedback and Contributions
We welcome your feedback and contributions to improve the web-based capa explorer. Please report any issues or suggest enhancements through the capa GitHub repository.
For developers interested in building or contributing to capa Explorer Web, please refer to our Development Guide.