From 7f57fccefb41439def281bf223fee0de5f02fbf4 Mon Sep 17 00:00:00 2001 From: Willi Ballenthin Date: Mon, 10 Jul 2023 02:55:50 +0200 Subject: [PATCH] fix lints after sync with master --- .github/ruff.toml | 1 + capa/features/extractors/cape/extractor.py | 4 ++-- capa/features/extractors/cape/global_.py | 2 +- capa/features/extractors/cape/process.py | 11 ++++++----- capa/features/extractors/cape/thread.py | 6 ++++-- capa/features/extractors/common.py | 2 -- capa/main.py | 2 +- scripts/show-features.py | 3 +-- tests/test_cape_features.py | 2 +- 9 files changed, 17 insertions(+), 16 deletions(-) diff --git a/.github/ruff.toml b/.github/ruff.toml index 3a5254a9..440d8ea7 100644 --- a/.github/ruff.toml +++ b/.github/ruff.toml @@ -53,6 +53,7 @@ exclude = [ "tests/test_freeze.py" = ["F401", "F811"] "tests/test_function_id.py" = ["F401", "F811"] "tests/test_viv_features.py" = ["F401", "F811"] +"tests/test_cape_features.py" = ["F401", "F811"] "tests/test_binja_features.py" = ["F401", "F811"] "tests/test_pefile_features.py" = ["F401", "F811"] "tests/test_dnfile_features.py" = ["F401", "F811"] diff --git a/capa/features/extractors/cape/extractor.py b/capa/features/extractors/cape/extractor.py index 5a0b7ce1..beeb22fd 100644 --- a/capa/features/extractors/cape/extractor.py +++ b/capa/features/extractors/cape/extractor.py @@ -6,14 +6,14 @@ # is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and limitations under the License. import logging -from typing import Dict, Tuple, Union, Iterator +from typing import Dict, Tuple, Iterator import capa.features.extractors.cape.file import capa.features.extractors.cape.thread import capa.features.extractors.cape.global_ import capa.features.extractors.cape.process from capa.features.common import Feature -from capa.features.address import NO_ADDRESS, Address, AbsoluteVirtualAddress +from capa.features.address import Address, AbsoluteVirtualAddress from capa.features.extractors.base_extractor import ThreadHandle, ProcessHandle, DynamicFeatureExtractor logger = logging.getLogger(__name__) diff --git a/capa/features/extractors/cape/global_.py b/capa/features/extractors/cape/global_.py index d6dc9b33..4a07e8c6 100644 --- a/capa/features/extractors/cape/global_.py +++ b/capa/features/extractors/cape/global_.py @@ -77,7 +77,7 @@ def extract_os(static) -> Iterator[Tuple[Feature, Address]]: yield from guess_elf_os(file_command) else: # the sample is shellcode - logger.debug(f"unsupported file format, file command output: {file_command}") + logger.debug("unsupported file format, file command output: %s", file_command) yield OS(OS_ANY), NO_ADDRESS diff --git a/capa/features/extractors/cape/process.py b/capa/features/extractors/cape/process.py index 293401f6..ec2cd124 100644 --- a/capa/features/extractors/cape/process.py +++ b/capa/features/extractors/cape/process.py @@ -6,14 +6,14 @@ # is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and limitations under the License. import logging -from typing import Any, Dict, List, Tuple, Iterator +from typing import Dict, List, Tuple, Iterator import capa.features.extractors.cape.file import capa.features.extractors.cape.thread import capa.features.extractors.cape.global_ import capa.features.extractors.cape.process from capa.features.common import String, Feature -from capa.features.address import NO_ADDRESS, Address, AbsoluteVirtualAddress +from capa.features.address import NO_ADDRESS, Address from capa.features.extractors.base_extractor import ThreadHandle, ProcessHandle logger = logging.getLogger(__name__) @@ -42,9 +42,10 @@ def extract_environ_strings(behavior: Dict, ph: ProcessHandle) -> Iterator[Tuple if not environ: return - for variable, value in environ.items(): - if value: - yield String(value), NO_ADDRESS + for value in environ.values(): + if not value: + continue + yield String(value), NO_ADDRESS def extract_features(behavior: Dict, ph: ProcessHandle) -> Iterator[Tuple[Feature, Address]]: diff --git a/capa/features/extractors/cape/thread.py b/capa/features/extractors/cape/thread.py index 43820df5..d9439d2c 100644 --- a/capa/features/extractors/cape/thread.py +++ b/capa/features/extractors/cape/thread.py @@ -12,7 +12,7 @@ from typing import Any, Dict, List, Tuple, Iterator import capa.features.extractors.cape.helpers from capa.features.insn import API, Number from capa.features.common import String, Feature -from capa.features.address import Address, DynamicAddress, AbsoluteVirtualAddress +from capa.features.address import Address, DynamicAddress from capa.features.extractors.base_extractor import ThreadHandle, ProcessHandle logger = logging.getLogger(__name__) @@ -40,7 +40,9 @@ def extract_call_features(behavior: Dict, ph: ProcessHandle, th: ThreadHandle) - if call["thread_id"] != tid: continue - # TODO this address may vary from the PE header, may read actual base from procdump.pe.imagebase or similar + # TODO(yelhamer): find correct base address used at runtime. + # this address may vary from the PE header, may read actual base from procdump.pe.imagebase or similar. + # https://github.com/mandiant/capa/issues/1618 caller = DynamicAddress(call["id"], int(call["caller"], 16)) # list similar to disassembly: arguments right-to-left, call for arg in call["arguments"][::-1]: diff --git a/capa/features/extractors/common.py b/capa/features/extractors/common.py index ddd6d12d..6beaa72d 100644 --- a/capa/features/extractors/common.py +++ b/capa/features/extractors/common.py @@ -1,5 +1,4 @@ import io -import json import logging import binascii import contextlib @@ -19,7 +18,6 @@ from capa.features.common import ( FORMAT_PE, FORMAT_ELF, OS_WINDOWS, - FORMAT_CAPE, FORMAT_FREEZE, FORMAT_RESULT, Arch, diff --git a/capa/main.py b/capa/main.py index 59587e22..8ff1a9ac 100644 --- a/capa/main.py +++ b/capa/main.py @@ -22,7 +22,7 @@ import textwrap import itertools import contextlib import collections -from typing import Any, Dict, List, Tuple, Union, Callable, cast +from typing import Any, Dict, List, Tuple, Callable, cast import halo import tqdm diff --git a/scripts/show-features.py b/scripts/show-features.py index 24d9dba2..a47997f2 100644 --- a/scripts/show-features.py +++ b/scripts/show-features.py @@ -69,7 +69,6 @@ import sys import logging import os.path import argparse -from typing import cast import capa.main import capa.rules @@ -104,7 +103,7 @@ def main(argv=None): capa.main.handle_common_args(args) try: - taste = capa.helpers.get_file_taste(args.sample) + _ = capa.helpers.get_file_taste(args.sample) except IOError as e: logger.error("%s", str(e)) return -1 diff --git a/tests/test_cape_features.py b/tests/test_cape_features.py index 043c0563..f1a29aba 100644 --- a/tests/test_cape_features.py +++ b/tests/test_cape_features.py @@ -6,7 +6,7 @@ # is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and limitations under the License. import fixtures -from fixtures import * +from fixtures import scope, sample @fixtures.parametrize(