mirror of
https://github.com/mandiant/capa.git
synced 2025-12-12 15:49:46 -08:00
capa/main.py: move has_rule_with_namespace() to capa.rules.RuleSet
This commit is contained in:
@@ -134,12 +134,6 @@ def set_vivisect_log_level(level):
|
||||
logging.getLogger("Elf").setLevel(level)
|
||||
|
||||
|
||||
def has_rule_with_namespace(rules: RuleSet, capabilities: MatchResults, namespace: str) -> bool:
|
||||
return any(
|
||||
rules.rules[rule_name].meta.get("namespace", "").startswith(namespace) for rule_name in capabilities.keys()
|
||||
)
|
||||
|
||||
|
||||
def is_supported_format(sample: Path) -> bool:
|
||||
"""
|
||||
Return if this is a supported file based on magic header values
|
||||
|
||||
@@ -43,7 +43,7 @@ import capa.features.file
|
||||
import capa.features.insn
|
||||
import capa.features.common
|
||||
import capa.features.basicblock
|
||||
from capa.engine import Statement, FeatureSet
|
||||
from capa.engine import Statement, FeatureSet, MatchResults
|
||||
from capa.features.common import MAX_BYTES_FEATURE_SIZE, Feature
|
||||
from capa.features.address import Address
|
||||
|
||||
@@ -1622,6 +1622,11 @@ class RuleSet:
|
||||
break
|
||||
return RuleSet(list(rules_filtered))
|
||||
|
||||
def has_rule_with_namespace(self, capabilities: MatchResults, namespace: str) -> bool:
|
||||
return any(
|
||||
self.rules[rule_name].meta.get("namespace", "").startswith(namespace) for rule_name in capabilities.keys()
|
||||
)
|
||||
|
||||
def match(self, scope: Scope, features: FeatureSet, addr: Address) -> Tuple[FeatureSet, ceng.MatchResults]:
|
||||
"""
|
||||
match rules from this ruleset at the given scope against the given features.
|
||||
|
||||
Reference in New Issue
Block a user