This commit is contained in:
William Ballenthin
2021-08-11 15:08:31 -06:00
parent 71d9ebd859
commit 34819b289d
7 changed files with 11 additions and 10 deletions

View File

@@ -285,9 +285,10 @@ def is_global_feature(feature):
is this a feature that is extracted at every scope?
today, this are OS and file format features.
"""
if (isinstance(feature, Characteristic)
if (
isinstance(feature, Characteristic)
and isinstance(feature.value, str)
and (feature.value.startswith("os/")
or feature.value.startswith("format/"))):
and (feature.value.startswith("os/") or feature.value.startswith("format/"))
):
return True
return False

View File

@@ -6,7 +6,6 @@ import contextlib
import capa.features.extractors.elf
from capa.features.common import CHARACTERISTIC_PE, CHARACTERISTIC_ELF, CHARACTERISTIC_WINDOWS, Characteristic
logger = logging.getLogger(__name__)

View File

@@ -9,16 +9,16 @@ import logging
import functools
import contextlib
import ida_loader
import idaapi
import ida_loader
import capa.ida.helpers
import capa.features.extractors.elf
from capa.features.common import CHARACTERISTIC_PE, CHARACTERISTIC_ELF, Characteristic
import capa.features.extractors.ida.file
import capa.features.extractors.ida.insn
import capa.features.extractors.ida.function
import capa.features.extractors.ida.basicblock
from capa.features.common import CHARACTERISTIC_PE, CHARACTERISTIC_ELF, Characteristic
from capa.features.extractors.base_extractor import FeatureExtractor

View File

@@ -27,6 +27,7 @@ logger = logging.getLogger("capa.detect-elf-os")
def main(argv=None):
if capa.helpers.is_runtime_ida():
from capa.ida.helpers import IDAIO
f: BinaryIO = IDAIO()
else:

View File

@@ -75,8 +75,8 @@ import capa.rules
import capa.engine
import capa.helpers
import capa.features
import capa.features.freeze
import capa.features.common
import capa.features.freeze
logger = logging.getLogger("capa.show-features")