diff --git a/capa/render/__init__.py b/capa/render/__init__.py index dbe13c54..773984c2 100644 --- a/capa/render/__init__.py +++ b/capa/render/__init__.py @@ -46,6 +46,8 @@ def convert_statement_to_result_document(statement): return { 'type': 'regex', 'pattern': statement.pattern, + # the string that was matched + 'match': statement.match, } elif isinstance(statement, capa.engine.Subscope): return { diff --git a/capa/render/vverbose.py b/capa/render/vverbose.py index 58051acc..c5e3009a 100644 --- a/capa/render/vverbose.py +++ b/capa/render/vverbose.py @@ -23,7 +23,10 @@ def render_statement(ostream, statement, indent=0): ostream.write(statement['subscope']) ostream.writeln(':') elif statement['type'] == 'regex': - ostream.writeln('string: /%s/' % (statement['pattern'])) + # regex is a `Statement` not a `Feature` + # this is because it doesn't get extracted, but applies to all strings in scope. + # so we have to handle it here + ostream.writeln('string: %s' % (statement['match'])) else: raise RuntimeError("unexpected match statement type: " + str(statement))