From 1cf36b5792dea74fd70d302513b62cee9d4013e6 Mon Sep 17 00:00:00 2001 From: Michael Hunhoff Date: Wed, 1 Jul 2020 13:38:20 -0600 Subject: [PATCH] adding new item type for subscope to help render --- capa/ida/explorer/item.py | 8 ++++++++ capa/ida/explorer/model.py | 7 ++++--- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/capa/ida/explorer/item.py b/capa/ida/explorer/item.py index 729faa4a..72a955b7 100644 --- a/capa/ida/explorer/item.py +++ b/capa/ida/explorer/item.py @@ -184,6 +184,14 @@ class CapaExplorerFunctionItem(CapaExplorerDataItem): self._data[0] = self.fmt % display +class CapaExplorerSubscopeItem(CapaExplorerDataItem): + + fmt = 'subscope(%s)' + + def __init__(self, parent, scope): + super(CapaExplorerSubscopeItem, self).__init__(parent, [self.fmt % scope, '', '']) + + class CapaExplorerBlockItem(CapaExplorerDataItem): """ store data relevant to capa basic block result """ diff --git a/capa/ida/explorer/model.py b/capa/ida/explorer/model.py index 7b3b21c7..98d292b9 100644 --- a/capa/ida/explorer/model.py +++ b/capa/ida/explorer/model.py @@ -16,7 +16,8 @@ from capa.ida.explorer.item import ( CapaExplorerByteViewItem, CapaExplorerBlockItem, CapaExplorerRuleMatchItem, - CapaExplorerFeatureItem + CapaExplorerFeatureItem, + CapaExplorerSubscopeItem ) import capa.ida.helpers @@ -105,7 +106,7 @@ class CapaExplorerDataModel(QtCore.QAbstractItemModel): if role == QtCore.Qt.FontRole and isinstance(item, (CapaExplorerRuleItem, CapaExplorerRuleMatchItem, CapaExplorerBlockItem, CapaExplorerFunctionItem, - CapaExplorerFeatureItem)) and \ + CapaExplorerFeatureItem, CapaExplorerSubscopeItem)) and \ column == CapaExplorerDataModel.COLUMN_INDEX_RULE_INFORMATION: # set bold font for top-level rules font = QtGui.QFont() @@ -334,7 +335,7 @@ class CapaExplorerDataModel(QtCore.QAbstractItemModel): return CapaExplorerFeatureItem(parent, display=display) elif statement['type'] == 'subscope': - return CapaExplorerFeatureItem(parent, 'subscope(%s)' % statement['subscope']) + return CapaExplorerSubscopeItem(parent, statement['subscope']) elif statement['type'] == 'regex': # regex is a `Statement` not a `Feature` # this is because it doesn't get extracted, but applies to all strings in scope.