diff --git a/capa/features/extractors/vmray/__init__.py b/capa/features/extractors/vmray/__init__.py index 8fbfa915..35c9c0fc 100644 --- a/capa/features/extractors/vmray/__init__.py +++ b/capa/features/extractors/vmray/__init__.py @@ -59,7 +59,7 @@ class VMRayAnalysis: self.exports[export.address] = export.api.name def _compute_imports(self): - # TODO (meh) + # TODO (meh): https://github.com/mandiant/capa/issues/2148 ... def _compute_sections(self): diff --git a/capa/features/extractors/vmray/call.py b/capa/features/extractors/vmray/call.py index c5f8d446..a653e660 100644 --- a/capa/features/extractors/vmray/call.py +++ b/capa/features/extractors/vmray/call.py @@ -1,3 +1,10 @@ +# Copyright (C) 2024 Mandiant, Inc. All Rights Reserved. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: [package root]/LICENSE.txt +# Unless required by applicable law or agreed to in writing, software distributed under the License +# is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and limitations under the License. import logging from typing import Tuple, Iterator @@ -21,7 +28,7 @@ def extract_call_features(ph: ProcessHandle, th: ThreadHandle, ch: CallHandle) - yields: Feature, address; where Feature is either: API, Number, or String. """ - # TODO update for new models + # TODO (meh): update for new models https://github.com/mandiant/capa/issues/2148 # print(ch) return diff --git a/capa/features/extractors/vmray/extractor.py b/capa/features/extractors/vmray/extractor.py index 5ddb3714..236ed945 100644 --- a/capa/features/extractors/vmray/extractor.py +++ b/capa/features/extractors/vmray/extractor.py @@ -59,7 +59,7 @@ class VMRayExtractor(DynamicFeatureExtractor): yield from capa.features.extractors.vmray.file.get_processes(self.analysis) def extract_process_features(self, ph: ProcessHandle) -> Iterator[Tuple[Feature, Address]]: - # TODO (meh) + # TODO (meh): https://github.com/mandiant/capa/issues/2148 yield from [] def get_process_name(self, ph) -> str: @@ -89,7 +89,7 @@ class VMRayExtractor(DynamicFeatureExtractor): yield from capa.features.extractors.vmray.call.extract_features(ph, th, ch) def get_call_name(self, ph, th, ch) -> str: - # TODO (meh) + # TODO (meh): https://github.com/mandiant/capa/issues/2148 raise NotImplementedError() @classmethod diff --git a/capa/features/extractors/vmray/file.py b/capa/features/extractors/vmray/file.py index 2b26f7d6..45b0d0af 100644 --- a/capa/features/extractors/vmray/file.py +++ b/capa/features/extractors/vmray/file.py @@ -22,7 +22,7 @@ def get_processes(analysis: VMRayAnalysis) -> Iterator[ProcessHandle]: processes: Dict[str, Process] = analysis.sv2.processes for _, process in processes.items(): - # TODO (meh) should we use the OS process ID or vmray-assigned ID? + # TODO (meh): should we use the OS process ID or vmray-assigned ID? https://github.com/mandiant/capa/issues/2148 pid = process.monitor_id ppid = processes[process.ref_parent_process.path[1]].monitor_id if process.ref_parent_process else 0 @@ -36,7 +36,7 @@ def extract_export_names(analysis: VMRayAnalysis) -> Iterator[Tuple[Feature, Add def extract_import_names(analysis: VMRayAnalysis) -> Iterator[Tuple[Feature, Address]]: - # TODO (meh) + # TODO (meh): https://github.com/mandiant/capa/issues/2148 yield from [] diff --git a/capa/features/extractors/vmray/models.py b/capa/features/extractors/vmray/models.py index 5e0ddd48..22db5a1d 100644 --- a/capa/features/extractors/vmray/models.py +++ b/capa/features/extractors/vmray/models.py @@ -11,7 +11,7 @@ from typing import Dict, List, Optional from pydantic import Field, BaseModel -### models flog.xml files +# models flog.xml files class FunctionCall(BaseModel): ts: str fncall_id: str @@ -42,7 +42,7 @@ class Flog(BaseModel): analysis: Analysis -### models for summary_v2.json files +# models for summary_v2.json files class GenericReference(BaseModel): path: List[str] source: str diff --git a/scripts/show-features.py b/scripts/show-features.py index b46432db..6cfb100e 100644 --- a/scripts/show-features.py +++ b/scripts/show-features.py @@ -229,7 +229,7 @@ def print_dynamic_features(processes, extractor: DynamicFeatureExtractor): for p in processes: print(f"proc: {extractor.get_process_name(p)} (ppid={p.address.ppid}, pid={p.address.pid})") - for feature, addr in extractor.extract_process_features(p): + for feature, _ in extractor.extract_process_features(p): if is_global_feature(feature): continue