This commit is contained in:
William Ballenthin
2020-07-14 08:42:54 -06:00
parent 0d71ea8a56
commit 028b0c3734
2 changed files with 18 additions and 16 deletions

View File

@@ -383,26 +383,29 @@ def main(argv=None):
]
format_help = ", ".join(["%s: %s" % (f[0], f[1]) for f in formats])
epilog = textwrap.dedent("""
examples:
identify capabilities in a binary
capa suspicous.exe
epilog = textwrap.dedent(
"""
examples:
identify capabilities in a binary
capa suspicous.exe
identify capabilities in 32-bit shellcode, see `-f` for all supported formats
capa -f sc32 shellcode.bin
identify capabilities in 32-bit shellcode, see `-f` for all supported formats
capa -f sc32 shellcode.bin
report match locations
capa -v suspicous.exe
report match locations
capa -v suspicous.exe
report all feature match details
capa -vv suspicious.exe
report all feature match details
capa -vv suspicious.exe
filter rules by meta fields, e.g. rule name or namespace
capa -t <rule name> suspicious.exe
""")
filter rules by meta fields, e.g. rule name or namespace
capa -t <rule name> suspicious.exe
"""
)
parser = argparse.ArgumentParser(description=__doc__, epilog=epilog,
formatter_class=argparse.RawDescriptionHelpFormatter)
parser = argparse.ArgumentParser(
description=__doc__, epilog=epilog, formatter_class=argparse.RawDescriptionHelpFormatter
)
parser.add_argument("sample", type=str, help="Path to sample to analyze")
parser.add_argument(
"-r",

View File

@@ -56,7 +56,6 @@ import capa.features
import capa.render.utils as rutils
import capa.features.freeze
import capa.features.extractors.viv
from capa.helpers import get_file_taste
logger = logging.getLogger("capa.show-capabilities-by-function")