gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2026-01-17 15:22:53 -08:00
Code Issues Packages Projects Releases Wiki Activity

support regex feature capa explorer

Browse Source
This commit is contained in:
Michael Hunhoff
2020-07-15 14:55:29 -06:00
parent 78dae308c2
commit 67cfb3866c
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
capa/ida/explorer/model.py
View File

@@ -488,18 +488,15 @@ class CapaExplorerDataModel(QtCore.QAbstractItemModel):
}
"""
display = self.capa_doc_feature_to_display(feature)
details = ""
if feature["type"] == "regex":
details = feature["match"]
if len(locations) == 1:
# only one location for feature so no need to nest children
parent2 = self.render_capa_doc_feature(
parent, feature, next(iter(locations)), doc, display=display, details=details
parent, feature, next(iter(locations)), doc, display=display,
)
else:
# feature has multiple children, nest under one parent feature node
parent2 = CapaExplorerFeatureItem(parent, display, details=details)
parent2 = CapaExplorerFeatureItem(parent, display)
for location in sorted(locations):
self.render_capa_doc_feature(parent2, feature, location, doc)
@@ -539,6 +536,9 @@ class CapaExplorerDataModel(QtCore.QAbstractItemModel):
parent, display, source=doc["rules"].get(feature[feature["type"]], {}).get("source", "")
)
if feature["type"] == "regex":
return CapaExplorerFeatureItem(parent, display, location, details=feature["match"])
if feature["type"] == "basicblock":
return CapaExplorerBlockItem(parent, location)