mirror of
https://github.com/mandiant/capa.git
synced 2025-12-12 15:49:46 -08:00
pep8
This commit is contained in:
@@ -218,7 +218,7 @@ def extract_insn_offset_features(f, bb, insn):
|
||||
# mov eax, [esi + ecx + 16384]
|
||||
operands = [o.strip() for o in insn.operands.split(",")]
|
||||
for operand in operands:
|
||||
if not "ptr" in operand:
|
||||
if "ptr" not in operand:
|
||||
continue
|
||||
if "esp" in operand or "ebp" in operand or "rbp" in operand:
|
||||
continue
|
||||
|
||||
@@ -83,7 +83,7 @@ BASIC_BLOCK_SCOPE = Scope.BASIC_BLOCK.value
|
||||
INSTRUCTION_SCOPE = Scope.INSTRUCTION.value
|
||||
|
||||
|
||||
SUPPORTED_FEATURES = {
|
||||
SUPPORTED_FEATURES: Dict[str, Set] = {
|
||||
FILE_SCOPE: {
|
||||
capa.features.common.MatchedRule,
|
||||
capa.features.file.Export,
|
||||
|
||||
@@ -311,7 +311,7 @@ def convert_rule(rule, rulename, cround, depth):
|
||||
|
||||
return yara_strings, yara_condition
|
||||
|
||||
############################## end def do_statement
|
||||
# end: def do_statement
|
||||
|
||||
yara_strings_list = []
|
||||
yara_condition_list = []
|
||||
@@ -390,7 +390,9 @@ def convert_rule(rule, rulename, cround, depth):
|
||||
logger.info("kid coming: " + repr(kid.name))
|
||||
# logger.info("grandchildren: " + repr(kid.children))
|
||||
|
||||
##### here we go into RECURSION ##################################################################################
|
||||
#
|
||||
# here we go into RECURSION
|
||||
#
|
||||
yara_strings_sub, yara_condition_sub, rule_comment_sub, incomplete_sub = convert_rule(
|
||||
kid, rulename, cround, depth
|
||||
)
|
||||
@@ -496,9 +498,7 @@ def convert_rule(rule, rulename, cround, depth):
|
||||
|
||||
yara_condition = "\n\t" + yara_condition_list[0]
|
||||
|
||||
logger.info(
|
||||
f"################# end of convert_rule() #strings: {len(yara_strings_list)} #conditions: {len(yara_condition_list)}"
|
||||
)
|
||||
logger.info(f"# end of convert_rule() #strings: {len(yara_strings_list)} #conditions: {len(yara_condition_list)}")
|
||||
logger.info(f"strings: {yara_strings} conditions: {yara_condition}")
|
||||
|
||||
return yara_strings, yara_condition, rule_comment, incomplete
|
||||
@@ -617,7 +617,7 @@ def convert_rules(rules, namespaces, cround):
|
||||
|
||||
# examples in capa can contain the same hash several times with different offset, so check if it's already there:
|
||||
# (keeping the offset might be interessting for some but breaks yara-ci for checking of the final rules
|
||||
if not value in seen_hashes:
|
||||
if value not in seen_hashes:
|
||||
yara_meta += "\t" + meta_name + ' = "' + value + '"\n'
|
||||
seen_hashes.append(value)
|
||||
|
||||
|
||||
@@ -247,7 +247,7 @@ class InvalidAttckOrMbcTechnique(Lint):
|
||||
self.enabled_frameworks = []
|
||||
|
||||
# This regex matches the format defined in the recommendation attribute
|
||||
self.reg = re.compile("^([\w\s-]+)::(.+) \[([A-Za-z0-9.]+)\]$")
|
||||
self.reg = re.compile("^([\\w\\s-]+)::(.+) \\[([A-Za-z0-9.]+)\\]$")
|
||||
|
||||
def _entry_check(self, framework, category, entry, eid):
|
||||
if category not in self.data[framework].keys():
|
||||
|
||||
Reference in New Issue
Block a user