This commit is contained in:
William Ballenthin
2021-03-04 18:06:06 -07:00
parent 004ddb3e66
commit d3caecc551
5 changed files with 14 additions and 11 deletions

View File

@@ -87,4 +87,4 @@ class VivisectFeatureExtractor(FeatureExtractor):
return viv_utils.flirt.is_library_function(self.vw, va)
def get_function_name(self, va):
return viv_utils.get_function_name(self.vw, va)
return viv_utils.get_function_name(self.vw, va)

View File

@@ -7,12 +7,12 @@
# See the License for the specific language governing permissions and limitations under the License.
import viv_utils
import viv_utils.flirt
import envi.memory
import viv_utils.flirt
import envi.archs.i386.disasm
import capa.features.extractors.helpers
import capa.features.extractors.viv
import capa.features.extractors.helpers
import capa.features.extractors.viv.helpers
from capa.features import (
ARCH_X32,

View File

@@ -10,8 +10,8 @@ See the License for the specific language governing permissions and limitations
"""
import os
import sys
import time
import gzip
import time
import hashlib
import logging
import os.path
@@ -262,7 +262,9 @@ def get_shellcode_vw(sample, arch="auto"):
vw_cands = []
for arch in ["i386", "amd64"]:
vw_cands.append(
viv_utils.getShellcodeWorkspace(sample_bytes, arch, base=SHELLCODE_BASE, analyze=False, should_save=False)
viv_utils.getShellcodeWorkspace(
sample_bytes, arch, base=SHELLCODE_BASE, analyze=False, should_save=False
)
)
if not vw_cands:
raise ValueError("could not generate vivisect workspace")
@@ -412,7 +414,7 @@ def get_extractor(path, format, backend, sigpaths, disable_progress=False):
path (str): file system path to file to analyze.
format (str): "auto" for autodetection or one of "pe", "sc32" or "sc64" to override.
sigpaths (List[str]): file system paths to .sig/.pat files to identify functions.
raises:
UnsupportedFormatError:
"""

View File

@@ -201,7 +201,9 @@ class DoesntMatchExample(Lint):
continue
try:
extractor = capa.main.get_extractor(path, "auto", capa.main.BACKEND_VIV, sigpaths=[], disable_progress=True)
extractor = capa.main.get_extractor(
path, "auto", capa.main.BACKEND_VIV, sigpaths=[], disable_progress=True
)
capabilities, meta = capa.main.find_capabilities(ctx["rules"], extractor, disable_progress=True)
except Exception as e:
logger.error("failed to extract capabilities: %s %s %s", rule.name, path, e)

View File

@@ -1,9 +1,8 @@
import pytest
from fixtures import get_function, pma16_01_extractor, extract_function_features
import capa.features.insn
from fixtures import pma16_01_extractor, get_function, extract_function_features
def test_function_id_simple_match(pma16_01_extractor):
assert pma16_01_extractor.is_library_function(0x407490) == True
@@ -18,7 +17,7 @@ def test_function_id_gz_pat(pma16_01_extractor):
@pytest.mark.xfail
def test_function_id_complex_match(pma16_01_extractor):
# 0x405714 is __spawnlp which requires recursive match of __spawnvp at 0x407FAB
# 0x405714 is __spawnlp which requires recursive match of __spawnvp at 0x407FAB
# (and __spawnvpe at 0x409DE8)
assert pma16_01_extractor.is_library_function(0x405714) == True
assert pma16_01_extractor.get_function_name(0x405714) == "__spawnlp"
@@ -27,4 +26,4 @@ def test_function_id_complex_match(pma16_01_extractor):
def test_function_id_api_feature(pma16_01_extractor):
f = get_function(pma16_01_extractor, 0x404548)
features = extract_function_features(pma16_01_extractor, f)
assert capa.features.insn.API("__aulldiv") in features
assert capa.features.insn.API("__aulldiv") in features