438 Commits

Author	SHA1	Message	Date
Willi Ballenthin	9ebea05933	show-capabilities-by-function: use new ResultDocument	2022-06-20 14:32:10 -06:00
Willi Ballenthin	3ef126fbd7	show-features: fix rendering addresses	2022-06-06 15:27:06 -06:00
Willi Ballenthin	1a290a38c4	Merge branch 'master' into feature-981	2022-06-06 14:07:51 -06:00
Willi Ballenthin	f8b10a2c0a	render: verbose: update to use new result document	2022-06-06 13:48:41 -06:00
Willi Ballenthin	867662ba5a	rules: remove unused rule-category meta	2022-06-06 13:43:44 -06:00
Moritz Raabe	1df60186f0	fix!: authors instead of author	2022-05-31 23:05:13 +02:00
Willi Ballenthin	4ae4bab254	lint: use meta.authors	2022-05-26 12:02:47 -06:00
Willi Ballenthin	9236a36ef4	rule: factor out is subscope check	2022-05-26 10:24:31 -06:00
Willi Ballenthin	02cef8297c	pep8	2022-05-25 15:27:56 -06:00
Willi Ballenthin	b1fa5be7b1	show-features: render features in a tree to better group scopes	2022-05-25 15:08:44 -06:00
Willi Ballenthin	d7cfa4ee96	features: make features implement __lt__	2022-05-25 15:08:26 -06:00
Willi Ballenthin	a4003d7d91	tests: fix scripts using json document	2022-05-24 14:50:17 -06:00
Moritz Raabe	d8c9941f6b	fix: filter address	2022-05-12 16:39:36 +02:00
Moritz Raabe	716a73dfb4	feat: add handles and type annotations	2022-05-12 15:42:25 +02:00
Willi Ballenthin	e029547035	show-features: learn to use Addresses	2022-04-08 18:33:49 -06:00
Mike Hunhoff	580a2d7e45	dotnet: basic detection and feature extraction (#987)	2022-04-08 14:55:00 -06:00
Willi Ballenthin	0c354cf268	capa2yara: fix rules paths	2022-04-06 12:36:28 -06:00
Willi Ballenthin	aff72ad983	capa_as_library: fix rules path is list now	2022-04-06 11:07:34 -06:00
Willi Ballenthin	11b773573e	lint: fix rules path	2022-04-05 17:17:44 -06:00
Willi Ballenthin	f923a4ea9b	linter: accept instruction scope	2022-04-05 12:24:41 -06:00
Willi Ballenthin	ecabd557a7	*: remove /x32 and /x64 flavors from number and offset features	2022-04-05 10:35:41 -06:00
Willi Ballenthin	bd6e62e9bf	Update scripts/lint.py ... Co-authored-by: Moritz <mr-tz@users.noreply.github.com>	2022-03-29 11:26:21 -06:00
Willi Ballenthin	963cfbf380	pep8	2022-03-28 13:17:35 -06:00
re-fox	37f51690d0	Update capa_as_library.py	2022-02-13 13:09:58 -05:00
Baptistin Boilot	d026d21073	linter: add MBC names and IDs to the linting script	2022-02-06 11:47:49 +01:00
Baptistin Boilot	2e8c2f40d6	linter: update linter-data.json with mitre att&ck references only	2022-01-26 00:11:01 +01:00
Baptistin Boilot	377c805fe7	linter: improve linter-data.json opening and add documentation ... - Open linter-data.json in byte mode - Add a comment explaining how to invoke the script	2022-01-24 22:48:59 +01:00
Baptistin Boilot	0c978a8def	scripts: fix typing issue in setup-linter-dependencies	2022-01-22 17:18:02 +01:00
Baptistin Boilot	c6ac239c5a	linter: fix imports and codingstyle	2022-01-22 16:45:50 +01:00
Baptistin Boilot	370ad6cdd7	docs: add code documentation and update changelog	2022-01-22 16:45:49 +01:00
Baptistin Boilot	2bcd725e04	linter: add the possibility to enable or disable mbc and att&ck linting	2022-01-22 16:45:47 +01:00
Baptistin Boilot	0b487546bb	linter: add mbc data extractor and linter	2022-01-22 16:45:46 +01:00
Baptistin Boilot	67d8d832c9	linter: refactor att&ck linter and add attck json data	2022-01-22 16:45:35 +01:00
Baptistin Boilot	fa99782f02	linter: add a linter rule that checks for invalid att&ck technique	2022-01-22 16:44:07 +01:00
Baptistin Boilot	60a30518bc	linter: add mitre att&ck ttps extraction script	2022-01-22 16:43:42 +01:00
Baptistin Boilot	4739d121a2	scripts: add backend parameter (-b) to show-features.py	2021-12-31 20:07:34 +01:00
William Ballenthin	e550d48bcd	linter: optional maps to some, not range	2021-11-10 14:13:37 -07:00
William Ballenthin	72c2ffc40b	linter: add checks for not and optional not under and	2021-11-10 13:47:30 -07:00
William Ballenthin	7a4aee592b	profile-time: add doc	2021-11-09 16:08:39 -07:00
William Ballenthin	f598acb8fc	scripts: remove old profiling scripts	2021-11-08 14:24:48 -07:00
William Ballenthin	a35be4a666	scripts: add py script for profiling time	2021-11-08 11:52:34 -07:00
William Ballenthin	3a12472be8	perf: render: show evaluate.feature counter	2021-11-05 15:23:34 -06:00
William Ballenthin	3d068fe3cd	scripts: add utilities for collecting profile traces	2021-11-04 13:17:38 -06:00
Moritz Raabe	e9170a1d4b	auto recognize shellcode based on file extension	2021-11-02 18:02:37 +01:00
William Ballenthin	4451b76f89	pep8	2021-10-26 15:21:28 -06:00
William Ballenthin	8903d2abcb	show-capabilities-by-function: also include matches from BBs in fn	2021-10-26 15:05:53 -06:00
William Ballenthin	328e13fbfe	main: compute function & bb layout ... so bb can be associated with function in output. only captures BBs that have a rule match, otherwise, there might be too much data captured. closes #130.	2021-10-26 15:04:50 -06:00
Moritz Raabe	8de69c639a	s/fireeye/mandiant	2021-09-29 12:55:16 +02:00
Moritz Raabe	8bb1a1cb5a	use viv-utils functions	2021-09-23 19:35:14 +02:00
William Ballenthin	282c0c2655	lint: guide mypy typing to address CI issues	2021-08-27 13:00:40 -06:00