mirror of
https://github.com/mandiant/capa.git
synced 2025-12-12 15:49:46 -08:00
pep8
This commit is contained in:
@@ -87,4 +87,4 @@ class VivisectFeatureExtractor(FeatureExtractor):
|
||||
return viv_utils.flirt.is_library_function(self.vw, va)
|
||||
|
||||
def get_function_name(self, va):
|
||||
return viv_utils.get_function_name(self.vw, va)
|
||||
return viv_utils.get_function_name(self.vw, va)
|
||||
|
||||
@@ -7,12 +7,12 @@
|
||||
# See the License for the specific language governing permissions and limitations under the License.
|
||||
|
||||
import viv_utils
|
||||
import viv_utils.flirt
|
||||
import envi.memory
|
||||
import viv_utils.flirt
|
||||
import envi.archs.i386.disasm
|
||||
|
||||
import capa.features.extractors.helpers
|
||||
import capa.features.extractors.viv
|
||||
import capa.features.extractors.helpers
|
||||
import capa.features.extractors.viv.helpers
|
||||
from capa.features import (
|
||||
ARCH_X32,
|
||||
|
||||
@@ -10,8 +10,8 @@ See the License for the specific language governing permissions and limitations
|
||||
"""
|
||||
import os
|
||||
import sys
|
||||
import time
|
||||
import gzip
|
||||
import time
|
||||
import hashlib
|
||||
import logging
|
||||
import os.path
|
||||
@@ -262,7 +262,9 @@ def get_shellcode_vw(sample, arch="auto"):
|
||||
vw_cands = []
|
||||
for arch in ["i386", "amd64"]:
|
||||
vw_cands.append(
|
||||
viv_utils.getShellcodeWorkspace(sample_bytes, arch, base=SHELLCODE_BASE, analyze=False, should_save=False)
|
||||
viv_utils.getShellcodeWorkspace(
|
||||
sample_bytes, arch, base=SHELLCODE_BASE, analyze=False, should_save=False
|
||||
)
|
||||
)
|
||||
if not vw_cands:
|
||||
raise ValueError("could not generate vivisect workspace")
|
||||
@@ -412,7 +414,7 @@ def get_extractor(path, format, backend, sigpaths, disable_progress=False):
|
||||
path (str): file system path to file to analyze.
|
||||
format (str): "auto" for autodetection or one of "pe", "sc32" or "sc64" to override.
|
||||
sigpaths (List[str]): file system paths to .sig/.pat files to identify functions.
|
||||
|
||||
|
||||
raises:
|
||||
UnsupportedFormatError:
|
||||
"""
|
||||
|
||||
@@ -201,7 +201,9 @@ class DoesntMatchExample(Lint):
|
||||
continue
|
||||
|
||||
try:
|
||||
extractor = capa.main.get_extractor(path, "auto", capa.main.BACKEND_VIV, sigpaths=[], disable_progress=True)
|
||||
extractor = capa.main.get_extractor(
|
||||
path, "auto", capa.main.BACKEND_VIV, sigpaths=[], disable_progress=True
|
||||
)
|
||||
capabilities, meta = capa.main.find_capabilities(ctx["rules"], extractor, disable_progress=True)
|
||||
except Exception as e:
|
||||
logger.error("failed to extract capabilities: %s %s %s", rule.name, path, e)
|
||||
|
||||
@@ -1,9 +1,8 @@
|
||||
import pytest
|
||||
from fixtures import get_function, pma16_01_extractor, extract_function_features
|
||||
|
||||
import capa.features.insn
|
||||
|
||||
from fixtures import pma16_01_extractor, get_function, extract_function_features
|
||||
|
||||
|
||||
def test_function_id_simple_match(pma16_01_extractor):
|
||||
assert pma16_01_extractor.is_library_function(0x407490) == True
|
||||
@@ -18,7 +17,7 @@ def test_function_id_gz_pat(pma16_01_extractor):
|
||||
|
||||
@pytest.mark.xfail
|
||||
def test_function_id_complex_match(pma16_01_extractor):
|
||||
# 0x405714 is __spawnlp which requires recursive match of __spawnvp at 0x407FAB
|
||||
# 0x405714 is __spawnlp which requires recursive match of __spawnvp at 0x407FAB
|
||||
# (and __spawnvpe at 0x409DE8)
|
||||
assert pma16_01_extractor.is_library_function(0x405714) == True
|
||||
assert pma16_01_extractor.get_function_name(0x405714) == "__spawnlp"
|
||||
@@ -27,4 +26,4 @@ def test_function_id_complex_match(pma16_01_extractor):
|
||||
def test_function_id_api_feature(pma16_01_extractor):
|
||||
f = get_function(pma16_01_extractor, 0x404548)
|
||||
features = extract_function_features(pma16_01_extractor, f)
|
||||
assert capa.features.insn.API("__aulldiv") in features
|
||||
assert capa.features.insn.API("__aulldiv") in features
|
||||
|
||||
Reference in New Issue
Block a user