diff --git a/capa/features/extractors/viv/insn.py b/capa/features/extractors/viv/insn.py index 142c0f3f..08cc431a 100644 --- a/capa/features/extractors/viv/insn.py +++ b/capa/features/extractors/viv/insn.py @@ -298,7 +298,7 @@ def extract_insn_peb_access_characteristic_features(f, bb, insn): ''' parse peb access from the given function. fs:[0x30] on x86, gs:[0x60] on x64 ''' - # TODO extract x64 + # TODO handle where fs/gs are loaded into a register or onto the stack and used later if insn.mnem not in ['push', 'mov']: return diff --git a/capa/main.py b/capa/main.py index c9f21126..5600caab 100644 --- a/capa/main.py +++ b/capa/main.py @@ -321,6 +321,10 @@ def render_capabilities_verbose(ruleset, results): - 0x40105d ''' for rule, ress in results.items(): + if ruleset.rules[rule].meta.get('capa/subscope-rule', False): + # don't display subscope rules + continue + rule_scope = ruleset.rules[rule].scope if rule_scope == capa.rules.FILE_SCOPE: # only display rule name at file scope @@ -396,6 +400,10 @@ def render_capabilities_vverbose(ruleset, results): - virtual address: 0x4010c8 ''' for rule, ress in results.items(): + if ruleset.rules[rule].meta.get('capa/subscope-rule', False): + # don't display subscope rules + continue + print('rule %s:' % (rule)) for (va, res) in sorted(ress, key=lambda p: p[0]): rule_scope = ruleset.rules[rule].scope @@ -686,6 +694,9 @@ def main(argv=None): if args.tag: rules = rules.filter_rules_by_meta(args.tag) logger.info('selected %s rules', len(rules)) + for i, r in enumerate(rules.rules, 1): + # TODO don't display subscope rules? + logger.debug(' %d. %s', i, r) except (IOError, capa.rules.InvalidRule, capa.rules.InvalidRuleSet) as e: logger.error('%s', str(e)) return -1