gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2025-12-05 20:40:05 -08:00
Code Issues Packages Projects Releases Wiki Activity
Files
7844ebb144af99d825563b7d329593ad644ee819
capa/web/public/index.html
Mike Hunhoff 7844ebb144 v9.3.1 (#2769)
2025-11-20 08:37:49 -07:00

471 lines
21 KiB
HTML
Raw Blame History

<!doctype html>
<!--
Copyright 2024 Google LLC
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<html lang="en" data-bs-theme="auto">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta name="description" content="">
<title>capa - extract capabilities from executable files</title>
<link rel="canonical" href="https://mandiant.github.io/capa/">
<link href="./css/bootstrap-5.3.3.min.css" rel="stylesheet" integrity="sha384-QWTKZyjpPEjISv5WaRU9OFeRpok6YctnYmDr5pNlyT2bRjXh0JMhjY6hW+ALEwIH">
<script src="./js/bootstrap-5.3.3.bundle.min.js" integrity="sha384-YvpcrYf0tY3lHB60NNkmXc5s9fDVZLESaAA55NDzOxhy9GkcIdslK1eN7N6jIeHz"></script>
<link rel="stylesheet" href="./rules/pagefind/pagefind-ui.css">
<link rel="stylesheet" href="./rules/pagefind/pagefind-modular-ui.css">
<script src="./rules/pagefind/pagefind-ui.js"></script>
<script defer src="https://cloud.umami.is/script.js" data-website-id="0bb8ff9e-fbcc-4ee2-9f9f-b337a2e8cc7f"></script>
<meta name="theme-color" content="#712cf9">
<link rel="icon" href="img/icon.ico" />
<style>
:root {
/* from the icon */
--capa-blue: #2593d7;
--capa-blue-darker: #1d74aa;
--bs-primary: var(--capa-blue);
--bs-primary-rgb: var(--capa-blue);
}
a:not(.btn) {
color: var(--capa-blue);
text-decoration: none;
}
a:not(.btn):hover {
text-decoration: underline;
}
.btn-primary {
--bs-btn-bg: var(--capa-blue);
--bs-btn-border-color: var(--capa-blue);
}
.btn:hover {
background-color: var(--capa-blue-darker);
border-color: var(--capa-blue-darker);
}
.text-justify {
text-align: justify;
}
body {
overflow-x: clip;
}
/* a link that looks like inline text, until you hover and see a colorful underline */
.understated-link {
color: var(--bs-body-color) !important;
text-decoration: none;
text-decoration-color: var(--capa-blue);
}
.understated-link:hover {
text-decoration: underline;
text-decoration-color: var(--capa-blue) !important;
}
.b-divider {
width: 100%;
height: 3rem;
background-color: rgba(0, 0, 0, .1);
border: solid rgba(0, 0, 0, .15);
border-width: 1px 0;
box-shadow: inset 0 .5em 1.5em rgba(0, 0, 0, .1), inset 0 .125em .5em rgba(0, 0, 0, .15);
}
</style>
<script defer src="https://cloud.umami.is/script.js" data-website-id="0bb8ff9e-fbcc-4ee2-9f9f-b337a2e8cc7f"></script>
</head>
<body>
<main>
<header
class="d-flex flex-wrap justify-content-center py-1 mb-4 border-bottom fixed-top"
style="background-color: rgba(255,255,255,0.95);
box-shadow: 0 0.5rem 1rem rgba(0,0,0,0.05),inset 0 -1px 0 rgba(0,0,0,0.15);"
>
<a href="/" class="d-flex align-items-center mb-3 mb-md-0 me-md-auto">
<img src="./img/logo.png" alt="capa logo" height=48 />
</a>
<ul class="nav nav-pills">
<li class="nav-item d-flex align-items-center"><a href="#rules" class="nav-link text-dark">Rules</a></li>
<!-- TODO(williballenthin): create this section (currently doesn't exist and URL doesn't go anywhere) -->
<li class="nav-item d-flex align-items-center"><a href="#examples" class="nav-link text-dark">Examples</a></li>
<li class="nav-item d-flex align-items-center"><a href="#download" class="nav-link text-dark">Download</a></li>
</ul>
</header>
<div class="container my-5 mt-3" style="margin-top: 4rem !important;">
<div class="row p-4 pb-0 pe-lg-0 pt-lg-5 align-items-center">
<div class="col-lg-7 p-3 p-lg-5 pt-lg-3">
<h1 class="display-4 fw-bold lh-1 text-body-emphasis">
Extract capabilities from executable files
</h1>
<p class="lead text-justify">
capa is the FLARE team's
<a href="https://github.com/mandiant/capa" class="understated-link">free and open-source tool</a>
to identify capabilities in executable files.
<!-- TODO(williballenthin): add links to each one of these use cases -->
Triage unknown files, guide reverse engineering, and hunt across a corpus for novel malware.
Refer to capa's rule set as an encyclopedia of techniques used in real-world attacks,
pivoting across <a href="https://attack.mitre.org/" class="understated-link">MITRE ATT&CK</a>
and <a href="https://github.com/MBCProject/mbc-markdown" class="understated-link">Malware Behavior Catalog (MBC)</a>
references.
</p>
<div class="d-grid gap-2 d-md-flex justify-content-md-start mb-4 mb-lg-3">
<a href="#download" type="button" class="btn btn-primary bs-primary btn-lg px-4 me-md-2 fw-bold">Download</a>
<a href="./rules/" type="button" class="btn btn-outline-secondary btn-lg px-4">Browse Rules</a>
</div>
</div>
<div class="col-lg-4 offset-lg-1 p-0">
<img
class="rounded-lg-3 shadow-lg"
style="border: 4px solid #f8f9fb;"
src="./img/capa-default-pma0101.png"
alt="default capa output"
width="720">
</div>
</div>
</div>
<div class="b-divider"></div>
<div id="rules" class="px-4 mt-5 text-center border-bottom">
<h1 class="display-4 fw-bold text-body-emphasis">Rules Crafted by Experts</h1>
<div class="col-lg-6 mx-auto text-start">
<p class="lead mb-4 text-justify">
capa recognizes behaviors by matching rules crafted by expert reverse engineers.
<p class="mb-4 text-justify">
Rules describe logical combinations of features familiar to human analysts.
Things like:
</p>
<ul class="my-0 py-0 mx-3">
<li>API calls, like <code>CreateRemoteThread</code>,</li>
<li>integer constants, like <code>0x100000001b3 = FNV prime</code>,</li>
<li>string references, like <code>"ZIG_DEBUG_COLOR"</code>.</li>
</ul>
<p class="my-4 text-justify">
capa looks for these features within instructions, basic blocks, and functions, having already disassembled the input file.
In contrast to YARA, which primarily searches for sequences of bytes, capa rules describe features at the code-level.
</p>
<div class="d-grid gap-2 d-sm-flex justify-content-sm-center mb-4">
<a href="./rules/" type="button" class="btn btn-primary btn-lg px-4 me-sm-3">Browse Rules</a>
<a href="https://github.com/mandiant/capa-rules/blob/master/doc/format.md" type="button" class="btn btn-outline-secondary btn-lg px-4">Learn the Syntax</a>
</div>
<div id="search" class="mb-4"></div>
</div>
<div class="overflow-hidden" style="max-height: 38vh;">
<div class="container px-5">
<img
src="./img/capa-rule-create-socket.png"
class="img-fluid border shadow-lg mb-4"
alt="capa rule source"
width="700"
height="500"
loading="lazy"
/>
</div>
</div>
</div>
<!-- TODO(williballenthin): need section for examples -->
<!-- such as: -->
<!-- - default output -->
<!-- - verbose output -->
<!-- - capa Explorer IDA Plugin -->
<!-- - capa Explorer Ghidra Plugin -->
<!-- - capa Explorer web application -->
<!-- - JSON output -->
<!-- - VT integration -->
<!-- we'll want screenshots and/or styled text inline -->
<!-- maybe also a bunch (all) of result documents from PMA or testfiles that people can browse -->
<div class="b-divider"></div>
<!-- TODO(williballenthin): auto-generate this section from release notes and git history -->
<div class="container col-xxl-8 px-4 py-5">
<div class="row flex-lg-row-reverse align-items-center g-5">
<h1>What's New</h1>
<h2 class="mt-3">Tool Updates</h2>
<h3 class="mt-2">v9.3.1 (<em>2025-11-19</em>)</h3>
<p class="mt-0">
This patch release fixes a missing import for the capa explorer plugin for IDA Pro.
</p>
<h3 class="mt-2">v9.3.0 (<em>2025-11-12</em>)</h3>
<p class="mt-0">
capa v9.3.0 comes with over 20 new and/or impoved rules.
For IDA users the capa explorer plugin is now available via the IDA Pro plugin repository and contains Qt compatibility layer for PyQt5 and PySide6 support.
Additionally a Binary Ninja bug has been fixed. Released binaries now include ARM64 binaries (Linux and macOS).
</p>
<h3 class="mt-2">v9.2.1 (<em>2025-06-06</em>)</h3>
<p class="mt-0">
This point release fixes bugs including removing an unnecessary PyInstaller warning message and enabling the standalone binary to execute on systems running older versions of glibc.
</p>
<h3 class="mt-2">v9.2.0 (<em>2025-06-03</em>)</h3>
<p class="mt-0">
This release improves a few aspects of dynamic analysis, including relaxing our validation on fields across many CAPE versions and processing additional VMRay submission file types, for example.
It also includes an updated rule pack containing new rules and rule fixes.
</p>
<h3 class="mt-2">v9.1.0 (<em>2025-03-02</em>)</h3>
<p class="mt-0">
This release improves a few aspects of dynamic analysis, relaxing our validation on fields across many CAPE versions, for example.
It also includes an updated rule pack in which many dynamic rules make better use of the "span of calls" scope.
</p>
<h3 class="mt-2">v9.0.0 (<em>2025-02-05</em>)</h3>
<p class="mt-0">
This release introduces a new scope for dynamic analysis, "span of calls",
that matches features against a across a sliding window of API calls within a thread.
Its useful for identifying behaviors that span multiple API calls,
such as <code>OpenFile</code>/<code>ReadFile</code>/<code>CloseFile</code>,
without having to analyze an entire thread, which may be very long.
The release also contains a number of bug fixes and enhancements by new contributors:
<a href="https://github.com/v1bh475u">@v1bh475u</a> and <a href="https://github.com/dhruvak001">@dhruvak001</a>.
Welcome and thank you!
</p>
<h3 class="mt-2">v8.0.1 (<em>2024-12-09</em>)</h3>
<p class="mt-0">
This point release fixes an issue with the IDAPython API to now handle IDA Pro 8.3, 8.4, and 9.0 correctly.
</p>
<h3 class="mt-2">v8.0.0 (<em>2024-12-09</em>)</h3>
<p class="mt-0">
capa <a href="https://github.com/mandiant/capa/releases/tag/v8.0.0">v8.0.0</a> adds support for IDA Pro 9.0 (and idalib). The release comes with various improvements and bug fixes for the Binary Ninja backend (including to load with database files) -- thanks to @xusheng6.
<br />
Additional bug fixes improve the dynamic and BinExport backends.
<br />
capa version 8 now requires Python 3.10 or newer.
</p>
<h3 class="mt-2">v7.4.0 (<em>2024-10-04</em>)</h3>
<p class="mt-0">
The <a href="https://github.com/mandiant/capa/releases/tag/v7.4.0">v7.4.0</a> capa release fixes a bug when processing VMRay analysis archives and enhances API extraction for all dynamic backends. For better terminal rendering capa now solely relies on the rich library.<br />
The standalone capa executable can now automatically detect installations of relevant third party applications and use their backends (notably, idalib and Binary Ninja). For the extra standalone Linux build we've upgraded from Python 3.11 to 3.12.
</p>
<h3 class="mt-2">v7.3.0 (<em>2024-09-20</em>)</h3>
<div class="mt-0">
The <a href="https://github.com/mandiant/capa/releases/tag/v7.3.0">capa v7.3.0</a> release comes with the following three major enhancements:
<p><strong>1. Support for VMRay sandbox analysis archives</strong>: Unlock powerful malware analysis with capa&#39;s new <a href="https://www.vmray.com/">VMRay sandbox</a> integration!
Simply provide a VMRay analysis archive, and capa will automatically extract and match capabilities to streamline your workflow. This is the second support for the analysis of dynamic
analysis results after <a href="https://www.mandiant.com/resources/blog/dynamic-capa-executable-behavior-cape-sandbox">CAPE</a>.</p>
<p><strong>2. Support for BinExport files generated by Ghidra</strong>: <a href="https://github.com/google/binexport">BinExport</a> files store disassembled data into a Protocol Buffer format.
capa now supports the analysis of BinExport files generated by Ghidra. Using Ghidra and the BinExport file format users can now analyze ARM (AARCH64) ELF files targeting Android.</p>
<p><strong>3. Introducing the capa rules website</strong>: You can now browse capa&#39;s default rule set at <a href="https://mandiant.github.io/capa/rules">https://mandiant.github.io/capa/rules</a>.
In modern terminals the CLI capa tool hyperlinks to resources on the web, including entries on the capa rules website.
Furthermore, <a href="https://mandiant.github.io/capa">https://mandiant.github.io/capa</a> provides a landing page for the capa tool project.</p>
</div>
<h3 class="mt-2">v7.2.0 (<em>2024-08-20</em>)</h3>
<p class="mt-0">
<a href="https://github.com/mandiant/capa/releases/tag/v7.2.0">capa v7.2.0</a>
introduces a first version of capa Explorer Web: a web-based user interface to inspect capa results using your browser.
capa Explorer Web was worked on by @s-ff as part of a GSoC project, and it is available at <a href="https://mandiant.github.io/capa/explorer/">https://mandiant.github.io/capa/explorer/</a>.
This release also adds a feature extractor for output from the DRAKVUF sandbox. Now, analysts can pass the resulting drakmon.log file to capa and extract capabilities from the artifacts captured by the sandbox.
</p>
<p class="mt-0">New features:</p>
<ul class="mt-0 ps-5">
<li>webui: explore capa analysis results in a web-based UI online and offline</li>
<li>support analyzing DRAKVUF traces</li>
<li>IDA extractor: extract names from dynamically resolved APIs stored in renamed global variables</li>
<li>cli: add the ability to select which specific functions or processes to analyze</li>
</ul>
</div>
</div>
<div class="b-divider"></div>
<!-- TODO(williballenthin): this whole section's text is terrible, aside from the headers maybe -->
<div class="container px-4 py-5">
<div class="row row-cols-1 row-cols-md-2 align-items-md-center g-5">
<div class="col d-flex flex-column align-items-start gap-2">
<h2 class="fw-bold text-body-emphasis">
Integrates with Popular Reverse Engineering Tools
</h2>
<p class="text-body-secondary">
<!-- TODO(williballenthin): add links for each of these tools -->
capa uses the results of static or dynamic analysis to find the capabilities of programs.
The tool can rely on many different analysis backends, including IDA, Ghidra, Binary Ninja, CAPE, DRAKVUF, and VMRay.
The capa Explorer plugins provide interfaces for understanding the behaviors in programs, directly within reverse engineering tools.
</p>
</div>
<div class="col">
<div class="row row-cols-1 row-cols-sm-2 g-4">
<div class="col d-flex flex-column gap-2">
<h3 class="fw-semibold mb-0 text-body-emphasis">
IDA Pro
</h3>
<p class="text-body-secondary">
<!-- TODO(williballenthin): add link to find out more -->
Use the capa Explorer IDA Plugin to guide your reverse engineering, zeroing in on the interesting functions by behavior.
</p>
</div>
<div class="col d-flex flex-column gap-2">
<h3 class="fw-semibold mb-0 text-body-emphasis">
Ghidra
</h3>
<p class="text-body-secondary">
<!-- TODO(williballenthin): add link to find out more -->
Invoke Ghidra in headless mode to collect features for capa, or use the capa Explorer Ghidra plugin to understand key functions.
</p>
</div>
<div class="col d-flex flex-column gap-2">
<h3 class="fw-semibold mb-0 text-body-emphasis">
Binary Ninja
</h3>
<p class="text-body-secondary">
<!-- TODO(williballenthin): add link to find out more -->
Use Binary Ninja as the disassembler backend, relying on its state-of-the-art code analysis to recover capabilities.
</p>
</div>
<div class="col d-flex flex-column gap-2">
<h3 class="fw-semibold mb-0 text-body-emphasis">
CAPE
</h3>
<p class="text-body-secondary">
<!-- TODO(williballenthin): add link to find out more -->
Analyze the API trace captured by CAPE as it detonates malware, summarizing the behaviors seen across thousands of function calls.
</p>
</div>
</div>
</div>
</div>
</div>
<!-- TODO(williballenthin): need section on the capa Explorer web application -->
<div class="b-divider"></div>
<div id="download" class="px-4 pt-5 text-center border-bottom">
<h1 class="display-4 fw-bold text-body-emphasis">
Download capa
</h1>
<div class="col-lg-8 mx-auto">
<p class="lead">
We distribute capa as a standalone executable and as a Python library.
</p>
<div class="row flex-lg-row align-items-center g-5 py-2 text-start">
<div class="col-10 col-sm-8 col-lg-6">
<p class="mb-4 text-justify">
The standalone executable comes ready-to-go with 890+ embedded rules.
Use this when analyzing files from the terminal on Windows, Linux, and macOS.
There's a <a href="https://github.com/mandiant/capa/raw/master/doc/capa_quickstart.pdf">quickstart guide here</a> (PDF).
</p>
<p class="text-center">
<a href="https://github.com/mandiant/capa/releases/latest/" type="button" class="btn btn-primary me-md-2 mb-3 fw-bold">
Download standalone
</a>
</p>
<p class="text-justify">
capa is already included with malware analysis distributions like
<a href="https://github.com/mandiant/flare-vm" class="understated-link">FLARE-VM</a>
and <a href="https://remnux.org/" class="understated-link">REmnux</a>.
</p>
</div>
<div class="col-lg-6">
<p class="text-justify">
The Python library makes it easy to integrate capa into other projects,
like our plugins for IDA Pro and Ghidra.
Follow the <a href="https://github.com/mandiant/capa/blob/master/doc/installation.md">
instructions here
</a>,
which starts with installation it from PyPI like this:
</p>
<pre class="py-3 text-center" style="border: 2px solid #eeeeee;"><code>pip install flare-capa</code></pre>
<p class="text-justify">
<a href="https://github.com/mandiant/capa/blob/master/scripts/bulk-process.py">Here's an example</a>
of using capa as a library to process many files in parallel.
</p>
</div>
</div>
</div>
</div>
<div class="bg-dark text-secondary px-4 pt-5 text-center">
<div class="py-5">
<img src="./img/icon.png" alt="capa icon"/>
<h2 class="display-5 fw-bold text-white">
capa
</h2>
<div class="col-lg-6 mx-auto">
<p class="fs-5 my-4">
The FLARE team's open-source tool to identify capabilities in executable files.
</p>
<div class="d-grid gap-4 d-sm-flex justify-content-sm-center mb-4">
<div><a href="#rules" class="fw-bold text-white text-decoration-none">Rules</a></div>
<div><a href="#examples" class="fw-bold text-white text-decoration-none">Examples</a></div>
<div><a href="#download" class="fw-bold text-white text-decoration-none">Download</a></div>
</div>
<p>
Copyright 2024 Google LLC<br />
Licensed under the Apache License, Version 2.0.
</p>
</div>
</div>
</div>
</main>
<script>
window.addEventListener('DOMContentLoaded', (event) => {
new PagefindUI({
element: "#search",
showSubResults: true,
showEmptyFilters: false,
excerptLength: 15,
translations: {
placeholder: "Search rules",
},
});
});
</script>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink