gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2025-12-12 23:59:48 -08:00
Code Issues Packages Projects Releases Wiki Activity

fix: api handling workaround (#1079)

Browse Source 
* fix: api handling workaround

* fix: workaround .NET api handling
This commit is contained in:
Moritz
2022-07-01 17:37:56 +02:00
committed by GitHub
parent 444c30d720
commit d210645aee
1 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
scripts/capa2yara.py
View File

@@ -180,7 +180,15 @@ def convert_rule(rule, rulename, cround, depth):
logger.info("doing api: " + repr(api))
# e.g. kernel32.CreateNamedPipe => look for kernel32.dll and CreateNamedPipe
if "." in api:
# TODO: improve .NET API call handling
if "::" in api:
mod, api = api.split("::")
var_name = "api_" + var_names.pop(0)
yara_strings += "\t$" + var_name + " = /\\b" + api + "(A|W)?\\b/ ascii wide\n"
yara_condition += "\t$" + var_name + " "
elif api.count(".") == 1:
dll, api = api.split(".")
# usage of regex is needed and /i because string search for "CreateMutex" in imports() doesn't look for e.g. CreateMutexA