mirror of
https://github.com/mandiant/capa.git
synced 2025-12-05 20:40:05 -08:00
3cd97ae9f2
Replace the header from source code files using the following script:
```Python
for dir_path, dir_names, file_names in os.walk("capa"):
for file_name in file_names:
# header are only in `.py` and `.toml` files
if file_name[-3:] not in (".py", "oml"):
continue
file_path = f"{dir_path}/{file_name}"
f = open(file_path, "rb+")
content = f.read()
m = re.search(OLD_HEADER, content)
if not m:
continue
print(f"{file_path}: {m.group('year')}")
content = content.replace(m.group(0), NEW_HEADER % m.group("year"))
f.seek(0)
f.write(content)
```
Some files had the copyright headers inside a `"""` comment and needed
manual changes before applying the script. `hook-vivisect.py` and
`pyinstaller.spec` didn't include the license in the header and also
needed manual changes.
The old header had the confusing sentence `All rights reserved`, which
does not make sense for an open source license. Replace the header by
the default Google header that corrects this issue and keep capa
consistent with other Google projects.
Adapt the linter to work with the new header.
Replace also the copyright text in the `web/public/index.html` file for
consistency.
293 lines
8.9 KiB
Python
293 lines
8.9 KiB
Python
# Copyright 2022 Google LLC
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
import copy
|
|
|
|
import pytest
|
|
import fixtures
|
|
|
|
import capa
|
|
import capa.engine as ceng
|
|
import capa.render.result_document as rdoc
|
|
import capa.features.freeze.features as frzf
|
|
|
|
|
|
def test_optional_node_from_capa():
|
|
node = rdoc.node_from_capa(
|
|
ceng.Some(
|
|
0,
|
|
[],
|
|
)
|
|
)
|
|
assert isinstance(node, rdoc.StatementNode)
|
|
assert isinstance(node.statement, rdoc.CompoundStatement)
|
|
assert node.statement.type == rdoc.CompoundStatementType.OPTIONAL
|
|
|
|
|
|
def test_some_node_from_capa():
|
|
node = rdoc.node_from_capa(
|
|
ceng.Some(
|
|
1,
|
|
[
|
|
capa.features.insn.Number(0),
|
|
],
|
|
)
|
|
)
|
|
assert isinstance(node, rdoc.StatementNode)
|
|
assert isinstance(node.statement, rdoc.SomeStatement)
|
|
|
|
|
|
def test_range_node_from_capa():
|
|
node = rdoc.node_from_capa(
|
|
ceng.Range(
|
|
capa.features.insn.Number(0),
|
|
)
|
|
)
|
|
assert isinstance(node, rdoc.StatementNode)
|
|
assert isinstance(node.statement, rdoc.RangeStatement)
|
|
|
|
|
|
def test_subscope_node_from_capa():
|
|
node = rdoc.node_from_capa(
|
|
ceng.Subscope(
|
|
capa.rules.Scope.BASIC_BLOCK,
|
|
capa.features.insn.Number(0),
|
|
)
|
|
)
|
|
assert isinstance(node, rdoc.StatementNode)
|
|
assert isinstance(node.statement, rdoc.SubscopeStatement)
|
|
|
|
|
|
def test_and_node_from_capa():
|
|
node = rdoc.node_from_capa(
|
|
ceng.And(
|
|
[
|
|
capa.features.insn.Number(0),
|
|
],
|
|
)
|
|
)
|
|
assert isinstance(node, rdoc.StatementNode)
|
|
assert isinstance(node.statement, rdoc.CompoundStatement)
|
|
assert node.statement.type == rdoc.CompoundStatementType.AND
|
|
|
|
|
|
def test_or_node_from_capa():
|
|
node = rdoc.node_from_capa(
|
|
ceng.Or(
|
|
[
|
|
capa.features.insn.Number(0),
|
|
],
|
|
)
|
|
)
|
|
assert isinstance(node, rdoc.StatementNode)
|
|
assert isinstance(node.statement, rdoc.CompoundStatement)
|
|
assert node.statement.type == rdoc.CompoundStatementType.OR
|
|
|
|
|
|
def test_not_node_from_capa():
|
|
node = rdoc.node_from_capa(
|
|
ceng.Not(
|
|
[
|
|
capa.features.insn.Number(0),
|
|
],
|
|
)
|
|
)
|
|
assert isinstance(node, rdoc.StatementNode)
|
|
assert isinstance(node.statement, rdoc.CompoundStatement)
|
|
assert node.statement.type == rdoc.CompoundStatementType.NOT
|
|
|
|
|
|
def test_os_node_from_capa():
|
|
node = rdoc.node_from_capa(capa.features.common.OS(""))
|
|
assert isinstance(node, rdoc.FeatureNode)
|
|
assert isinstance(node.feature, frzf.OSFeature)
|
|
|
|
|
|
def test_arch_node_from_capa():
|
|
node = rdoc.node_from_capa(capa.features.common.Arch(""))
|
|
assert isinstance(node, rdoc.FeatureNode)
|
|
assert isinstance(node.feature, frzf.ArchFeature)
|
|
|
|
|
|
def test_format_node_from_capa():
|
|
node = rdoc.node_from_capa(capa.features.common.Format(""))
|
|
assert isinstance(node, rdoc.FeatureNode)
|
|
assert isinstance(node.feature, frzf.FormatFeature)
|
|
|
|
|
|
def test_match_node_from_capa():
|
|
node = rdoc.node_from_capa(capa.features.common.MatchedRule(""))
|
|
assert isinstance(node, rdoc.FeatureNode)
|
|
assert isinstance(node.feature, frzf.MatchFeature)
|
|
|
|
|
|
def test_characteristic_node_from_capa():
|
|
node = rdoc.node_from_capa(capa.features.common.Characteristic(""))
|
|
assert isinstance(node, rdoc.FeatureNode)
|
|
assert isinstance(node.feature, frzf.CharacteristicFeature)
|
|
|
|
|
|
def test_substring_node_from_capa():
|
|
node = rdoc.node_from_capa(capa.features.common.Substring(""))
|
|
assert isinstance(node, rdoc.FeatureNode)
|
|
assert isinstance(node.feature, frzf.SubstringFeature)
|
|
|
|
|
|
def test_regex_node_from_capa():
|
|
node = rdoc.node_from_capa(capa.features.common.Regex(""))
|
|
assert isinstance(node, rdoc.FeatureNode)
|
|
assert isinstance(node.feature, frzf.RegexFeature)
|
|
|
|
|
|
def test_class_node_from_capa():
|
|
node = rdoc.node_from_capa(capa.features.common.Class(""))
|
|
assert isinstance(node, rdoc.FeatureNode)
|
|
assert isinstance(node.feature, frzf.ClassFeature)
|
|
|
|
|
|
def test_namespace_node_from_capa():
|
|
node = rdoc.node_from_capa(capa.features.common.Namespace(""))
|
|
assert isinstance(node, rdoc.FeatureNode)
|
|
assert isinstance(node.feature, frzf.NamespaceFeature)
|
|
|
|
|
|
def test_bytes_node_from_capa():
|
|
node = rdoc.node_from_capa(capa.features.common.Bytes(b""))
|
|
assert isinstance(node, rdoc.FeatureNode)
|
|
assert isinstance(node.feature, frzf.BytesFeature)
|
|
|
|
|
|
def test_export_node_from_capa():
|
|
node = rdoc.node_from_capa(capa.features.file.Export(""))
|
|
assert isinstance(node, rdoc.FeatureNode)
|
|
assert isinstance(node.feature, frzf.ExportFeature)
|
|
|
|
|
|
def test_import_node_from_capa():
|
|
node = rdoc.node_from_capa(capa.features.file.Import(""))
|
|
assert isinstance(node, rdoc.FeatureNode)
|
|
assert isinstance(node.feature, frzf.ImportFeature)
|
|
|
|
|
|
def test_section_node_from_capa():
|
|
node = rdoc.node_from_capa(capa.features.file.Section(""))
|
|
assert isinstance(node, rdoc.FeatureNode)
|
|
assert isinstance(node.feature, frzf.SectionFeature)
|
|
|
|
|
|
def test_function_name_node_from_capa():
|
|
node = rdoc.node_from_capa(capa.features.file.FunctionName(""))
|
|
assert isinstance(node, rdoc.FeatureNode)
|
|
assert isinstance(node.feature, frzf.FunctionNameFeature)
|
|
|
|
|
|
def test_api_node_from_capa():
|
|
node = rdoc.node_from_capa(capa.features.insn.API(""))
|
|
assert isinstance(node, rdoc.FeatureNode)
|
|
assert isinstance(node.feature, frzf.APIFeature)
|
|
|
|
|
|
def test_property_node_from_capa():
|
|
node = rdoc.node_from_capa(capa.features.insn.Property(""))
|
|
assert isinstance(node, rdoc.FeatureNode)
|
|
assert isinstance(node.feature, frzf.PropertyFeature)
|
|
|
|
|
|
def test_number_node_from_capa():
|
|
node = rdoc.node_from_capa(capa.features.insn.Number(0))
|
|
assert isinstance(node, rdoc.FeatureNode)
|
|
assert isinstance(node.feature, frzf.NumberFeature)
|
|
|
|
|
|
def test_offset_node_from_capa():
|
|
node = rdoc.node_from_capa(capa.features.insn.Offset(0))
|
|
assert isinstance(node, rdoc.FeatureNode)
|
|
assert isinstance(node.feature, frzf.OffsetFeature)
|
|
|
|
|
|
def test_mnemonic_node_from_capa():
|
|
node = rdoc.node_from_capa(capa.features.insn.Mnemonic(""))
|
|
assert isinstance(node, rdoc.FeatureNode)
|
|
assert isinstance(node.feature, frzf.MnemonicFeature)
|
|
|
|
|
|
def test_operand_number_node_from_capa():
|
|
node = rdoc.node_from_capa(capa.features.insn.OperandNumber(0, 0))
|
|
assert isinstance(node, rdoc.FeatureNode)
|
|
assert isinstance(node.feature, frzf.OperandNumberFeature)
|
|
|
|
|
|
def test_operand_offset_node_from_capa():
|
|
node = rdoc.node_from_capa(capa.features.insn.OperandOffset(0, 0))
|
|
assert isinstance(node, rdoc.FeatureNode)
|
|
assert isinstance(node.feature, frzf.OperandOffsetFeature)
|
|
|
|
|
|
def test_basic_block_node_from_capa():
|
|
node = rdoc.node_from_capa(capa.features.basicblock.BasicBlock(""))
|
|
assert isinstance(node, rdoc.FeatureNode)
|
|
assert isinstance(node.feature, frzf.BasicBlockFeature)
|
|
|
|
|
|
def assert_round_trip(rd: rdoc.ResultDocument):
|
|
one = rd
|
|
|
|
doc = one.model_dump_json(exclude_none=True)
|
|
two = rdoc.ResultDocument.model_validate_json(doc)
|
|
|
|
# show the round trip works
|
|
# first by comparing the objects directly,
|
|
# which works thanks to pydantic model equality.
|
|
assert one == two
|
|
# second by showing their json representations are the same.
|
|
assert one.model_dump_json(exclude_none=True) == two.model_dump_json(exclude_none=True)
|
|
|
|
# now show that two different versions are not equal.
|
|
three = copy.deepcopy(two)
|
|
three.meta.__dict__.update({"version": "0.0.0"})
|
|
assert one.meta.version != three.meta.version
|
|
assert one != three
|
|
assert one.model_dump_json(exclude_none=True) != three.model_dump_json(exclude_none=True)
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"rd_file",
|
|
[
|
|
pytest.param("a3f3bbc_rd"),
|
|
pytest.param("al_khaserx86_rd"),
|
|
pytest.param("al_khaserx64_rd"),
|
|
pytest.param("a076114_rd"),
|
|
pytest.param("pma0101_rd"),
|
|
pytest.param("dotnet_1c444e_rd"),
|
|
],
|
|
)
|
|
def test_round_trip(request, rd_file):
|
|
rd: rdoc.ResultDocument = request.getfixturevalue(rd_file)
|
|
assert_round_trip(rd)
|
|
|
|
|
|
def test_json_to_rdoc():
|
|
path = fixtures.get_data_path_by_name("pma01-01-rd")
|
|
assert isinstance(rdoc.ResultDocument.from_file(path), rdoc.ResultDocument)
|
|
|
|
|
|
def test_rdoc_to_capa():
|
|
path = fixtures.get_data_path_by_name("pma01-01-rd")
|
|
|
|
rd = rdoc.ResultDocument.from_file(path)
|
|
|
|
meta, capabilites = rd.to_capa()
|
|
assert isinstance(meta, rdoc.Metadata)
|
|
assert isinstance(capabilites, dict)
|