mirror of
https://github.com/mandiant/capa.git
synced 2025-12-12 15:49:46 -08:00
features/insn.py: revert added strace-based API feature
This commit is contained in:
@@ -6,7 +6,7 @@
|
||||
# is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and limitations under the License.
|
||||
import abc
|
||||
from typing import Dict, Tuple, Union, Optional
|
||||
from typing import Union, Optional
|
||||
|
||||
import capa.helpers
|
||||
from capa.features.common import VALID_FEATURE_ACCESS, Feature
|
||||
@@ -21,56 +21,8 @@ def hex(n: int) -> str:
|
||||
|
||||
|
||||
class API(Feature):
|
||||
def __init__(self, signature: str, description=None):
|
||||
if signature.isidentifier():
|
||||
# api call is in the legacy format
|
||||
super().__init__(signature, description=description)
|
||||
self.args: Dict[str, str] = {}
|
||||
self.ret = ""
|
||||
else:
|
||||
# api call is in the strace format and therefore has to be parsed
|
||||
name, self.args, self.ret = self.parse_signature(signature)
|
||||
super().__init__(name, description=description)
|
||||
|
||||
# store the original signature for hashing purposes
|
||||
self.signature = signature
|
||||
|
||||
def __hash__(self):
|
||||
return hash(self.signature)
|
||||
|
||||
def __eq__(self, other):
|
||||
if not isinstance(other, API):
|
||||
return False
|
||||
|
||||
assert isinstance(other, API)
|
||||
if {} in (self.args, other.args) or "" in (self.ret, other.ret):
|
||||
# Legacy API feature
|
||||
return super().__eq__(other)
|
||||
|
||||
# API call with arguments
|
||||
return super().__eq__(other) and self.args == other.args and self.ret == other.ret
|
||||
|
||||
def parse_signature(self, signature: str) -> Tuple[str, Dict[str, str], str]:
|
||||
# todo: optimize this method and improve the code quality
|
||||
import re
|
||||
|
||||
args: Dict[str, str] = {}
|
||||
ret = ""
|
||||
|
||||
match = re.findall(r"(.+\(.*\)) ?=? ?([^=]*)", signature)
|
||||
if not match:
|
||||
return "", {}, ""
|
||||
if len(match[0]) == 2:
|
||||
ret = match[0][1]
|
||||
|
||||
match = re.findall(r"(.*)\((.*)\)", match[0][0])
|
||||
if len(match[0]) == 2:
|
||||
args_: Dict[str, str] = (match[0][1] + ", ").split(", ")
|
||||
map(lambda x: {f"arg{x[0]}": x[1]}, enumerate(args))
|
||||
for num, arg in enumerate(args_):
|
||||
args.update({f"arg {0}": arg})
|
||||
|
||||
return match[0][0], args, ret
|
||||
def __init__(self, name: str, description=None):
|
||||
super().__init__(name, description=description)
|
||||
|
||||
|
||||
class _AccessFeature(Feature, abc.ABC):
|
||||
|
||||
Reference in New Issue
Block a user