mirror of
https://github.com/mandiant/capa.git
synced 2025-12-28 05:33:20 -08:00
cf3494d427
* initial commit * update changelog * Update CHANGELOG.md * Update pyproject.toml * Apply suggestions from code review: Typos Co-authored-by: Vasco Schiavo <115561717+VascoSch92@users.noreply.github.com> * capa/helpers.py: update if/else statement Co-authored-by: Vasco Schiavo <115561717+VascoSch92@users.noreply.github.com> * loader.py: replace print() statement with log.info() * Update capa/features/extractors/drakvuf/models.py Co-authored-by: Moritz <mr-tz@users.noreply.github.com> * extractors/drakvuf/call.py: yield arguments right to left * extractors/drakvuf/file.py: add a TODO comment for extracting more file features * extractors/drakvuf/global_.py: add arch extraction * extractors/drakvuf/helpers.py: ignore null pids * capa/helpers.py: mention msgspec.json explicitely * capa/helpers.py: generalize empty sandbox reports error logging * capa/loader.py: log jsonl garbage collection into debug * features/extractors/drakvuf/models.py: add documentation for SystemCall class * capa/main.py: fix erroneous imports * drakvuf extractor: fixed faulty type annotations * fix black formatting * fix flake8 issues * drakvuf file extraction: add link to tracking issue * drakvuf reports: add the ability to read gzip-compressed report files * capa/helpers.py: fix mypy issues * apply review comments * drakvuf/helpers.py: add more information about null pid * drakvuf/file.py: remove discovered_dlls file strings extraction * capa/helpers.py: add comments for the dynamic extensions * capa/helpers.py: log bad lines * capa/helpers.py: add gzip support for reading one jsonl line * drakvuf/helpers.py: add comment for sort_calls() * tests/fixtures.py: add TODO for unifying CAPE and Drakvuf tests * drakvuf/models.py: add TODO comment for supporting more drakvuf plugins * tests/fixtures.py: remove obsolete file strings tests * Update capa/main.py Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com> * Update capa/features/extractors/drakvuf/models.py Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com> * Update capa/features/extractors/drakvuf/models.py Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com> * Update capa/features/extractors/drakvuf/call.py Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com> * Update CHANGELOG.md Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com> * Update capa/features/extractors/drakvuf/helpers.py Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com> * review comments * Update capa/features/extractors/drakvuf/extractor.py Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com> * Update capa/features/extractors/drakvuf/models.py Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com> * styling * drakvuf/extractor.py: black linting * drakvuf/models.py: remove need to empty report checking * tests: add drakvuf models test * Update capa/features/extractors/drakvuf/global_.py Co-authored-by: msm-cert <156842376+msm-cert@users.noreply.github.com> * Update tests/test_cape_features.py Co-authored-by: msm-cert <156842376+msm-cert@users.noreply.github.com> * Update capa/features/extractors/drakvuf/models.py Co-authored-by: msm-cert <156842376+msm-cert@users.noreply.github.com> * Apply suggestions from code review: rename Drakvuf to DRAKVUF Co-authored-by: msm-cert <156842376+msm-cert@users.noreply.github.com> * drakvuf/call.py: use int(..., 0) instead of str_to_number() * remove str_to_number * drakvuf/call.py: yield argument memory address value as well * Update call.py: remove verbosity in yield statement * Update call.py: yield missing address as well * drakvuf/call.py: yield entire argument string only * update readme.md * Update README.md: typo * Update CHANGELOG.md Co-authored-by: msm-cert <156842376+msm-cert@users.noreply.github.com> --------- Co-authored-by: Vasco Schiavo <115561717+VascoSch92@users.noreply.github.com> Co-authored-by: Moritz <mr-tz@users.noreply.github.com> Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com> Co-authored-by: msm-cert <156842376+msm-cert@users.noreply.github.com>
114 lines
5.6 KiB
Python
114 lines
5.6 KiB
Python
# Copyright (C) 2023 Mandiant, Inc. All Rights Reserved.
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at: [package root]/LICENSE.txt
|
|
# Unless required by applicable law or agreed to in writing, software distributed under the License
|
|
# is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and limitations under the License.
|
|
|
|
import fixtures
|
|
|
|
import capa.main
|
|
import capa.features.file
|
|
import capa.features.insn
|
|
import capa.features.common
|
|
import capa.features.basicblock
|
|
|
|
DYNAMIC_CAPE_FEATURE_PRESENCE_TESTS = sorted(
|
|
[
|
|
# file/string
|
|
("0000a657", "file", capa.features.common.String("T_Ba?.BcRJa"), True),
|
|
("0000a657", "file", capa.features.common.String("GetNamedPipeClientSessionId"), True),
|
|
("0000a657", "file", capa.features.common.String("nope"), False),
|
|
# file/sections
|
|
("0000a657", "file", capa.features.file.Section(".rdata"), True),
|
|
("0000a657", "file", capa.features.file.Section(".nope"), False),
|
|
# file/imports
|
|
("0000a657", "file", capa.features.file.Import("NdrSimpleTypeUnmarshall"), True),
|
|
("0000a657", "file", capa.features.file.Import("Nope"), False),
|
|
# file/exports
|
|
("0000a657", "file", capa.features.file.Export("Nope"), False),
|
|
# process/environment variables
|
|
(
|
|
"0000a657",
|
|
"process=(1180:3052)",
|
|
capa.features.common.String("C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn.exe"),
|
|
True,
|
|
),
|
|
("0000a657", "process=(1180:3052)", capa.features.common.String("nope"), False),
|
|
# thread/api calls
|
|
("0000a657", "process=(2852:3052),thread=2804", capa.features.insn.API("NtQueryValueKey"), True),
|
|
("0000a657", "process=(2852:3052),thread=2804", capa.features.insn.API("GetActiveWindow"), False),
|
|
# thread/number call argument
|
|
("0000a657", "process=(2852:3052),thread=2804", capa.features.insn.Number(0x000000EC), True),
|
|
("0000a657", "process=(2852:3052),thread=2804", capa.features.insn.Number(110173), False),
|
|
# thread/string call argument
|
|
("0000a657", "process=(2852:3052),thread=2804", capa.features.common.String("SetThreadUILanguage"), True),
|
|
("0000a657", "process=(2852:3052),thread=2804", capa.features.common.String("nope"), False),
|
|
("0000a657", "process=(2852:3052),thread=2804,call=56", capa.features.insn.API("NtQueryValueKey"), True),
|
|
("0000a657", "process=(2852:3052),thread=2804,call=1958", capa.features.insn.API("nope"), False),
|
|
],
|
|
# order tests by (file, item)
|
|
# so that our LRU cache is most effective.
|
|
key=lambda t: (t[0], t[1]),
|
|
)
|
|
|
|
DYNAMIC_CAPE_FEATURE_COUNT_TESTS = sorted(
|
|
# TODO(yelhamer): use the same sample for testing CAPE and DRAKVUF extractors
|
|
# https://github.com/mandiant/capa/issues/2180
|
|
[
|
|
# file/string
|
|
("0000a657", "file", capa.features.common.String("T_Ba?.BcRJa"), 1),
|
|
("0000a657", "file", capa.features.common.String("GetNamedPipeClientSessionId"), 1),
|
|
("0000a657", "file", capa.features.common.String("nope"), 0),
|
|
# file/sections
|
|
("0000a657", "file", capa.features.file.Section(".rdata"), 1),
|
|
("0000a657", "file", capa.features.file.Section(".nope"), 0),
|
|
# file/imports
|
|
("0000a657", "file", capa.features.file.Import("NdrSimpleTypeUnmarshall"), 1),
|
|
("0000a657", "file", capa.features.file.Import("Nope"), 0),
|
|
# file/exports
|
|
("0000a657", "file", capa.features.file.Export("Nope"), 0),
|
|
# process/environment variables
|
|
(
|
|
"0000a657",
|
|
"process=(1180:3052)",
|
|
capa.features.common.String("C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn.exe"),
|
|
2,
|
|
),
|
|
("0000a657", "process=(1180:3052)", capa.features.common.String("nope"), 0),
|
|
# thread/api calls
|
|
("0000a657", "process=(2852:3052),thread=2804", capa.features.insn.API("NtQueryValueKey"), 7),
|
|
("0000a657", "process=(2852:3052),thread=2804", capa.features.insn.API("GetActiveWindow"), 0),
|
|
# thread/number call argument
|
|
("0000a657", "process=(2852:3052),thread=2804", capa.features.insn.Number(0x000000EC), 1),
|
|
("0000a657", "process=(2852:3052),thread=2804", capa.features.insn.Number(110173), 0),
|
|
# thread/string call argument
|
|
("0000a657", "process=(2852:3052),thread=2804", capa.features.common.String("SetThreadUILanguage"), 1),
|
|
("0000a657", "process=(2852:3052),thread=2804", capa.features.common.String("nope"), 0),
|
|
("0000a657", "process=(2852:3052),thread=2804,call=56", capa.features.insn.API("NtQueryValueKey"), 1),
|
|
("0000a657", "process=(2852:3052),thread=2804,call=1958", capa.features.insn.API("nope"), 0),
|
|
],
|
|
# order tests by (file, item)
|
|
# so that our LRU cache is most effective.
|
|
key=lambda t: (t[0], t[1]),
|
|
)
|
|
|
|
|
|
@fixtures.parametrize(
|
|
"sample,scope,feature,expected",
|
|
DYNAMIC_CAPE_FEATURE_PRESENCE_TESTS,
|
|
indirect=["sample", "scope"],
|
|
)
|
|
def test_cape_features(sample, scope, feature, expected):
|
|
fixtures.do_test_feature_presence(fixtures.get_cape_extractor, sample, scope, feature, expected)
|
|
|
|
|
|
@fixtures.parametrize(
|
|
"sample,scope,feature,expected",
|
|
DYNAMIC_CAPE_FEATURE_COUNT_TESTS,
|
|
indirect=["sample", "scope"],
|
|
)
|
|
def test_cape_feature_counts(sample, scope, feature, expected):
|
|
fixtures.do_test_feature_count(fixtures.get_cape_extractor, sample, scope, feature, expected)
|