N0stalgikow
0eb4291b25
Updating copyright across all files based on when it was first introduced. ( #2027 )
...
* updating copyright, back to the date of origin of file
* updating regex to account for linter violation
2024-03-13 14:04:53 +01:00
Willi Ballenthin
c3301d3b3f
refactor main to for ease of integration ( #1948 )
...
* main: split main into a bunch of "main routines"
[wip] since there are a few references to BinExport2
that are in progress elsewhre. Next commit will remove them.
* main: remove references to wip BinExport2 code
* changelog
* main: rename first position argument "input_file"
closes #1946
* main: linters
* main: move rule-related routines to capa.rules
ref #1821
* main: extract routines to capa.loader module
closes #1821
* add loader module
* loader: learn to load freeze format
* freeze: use new cli arg handling
* Update capa/loader.py
Co-authored-by: Moritz <mr-tz@users.noreply.github.com >
* main: remove duplicate documentation
* main: add doc about where some functions live
* scripts: migrate to new main wrapper helper functions
* scripts: port to main routines
* main: better handle auto-detection of backend
* scripts: migrate bulk-process to main wrappers
* scripts: migrate scripts to main wrappers
* main: rename *_from_args to *_from_cli
* changelog
* cache-ruleset: remove duplication
* main: fix tag handling
* cache-ruleset: fix cli args
* cache-ruleset: fix special rule cli handling
* scripts: fix type bytes
* main: remove old TODO message
* loader: fix references to binja extractor
---------
Co-authored-by: Moritz <mr-tz@users.noreply.github.com >
2024-01-29 13:59:05 +01:00
Yacine Elhamer
96fb204d9d
move capa.features.capabilities to capa.capabilities, and update scripts
2023-10-20 09:54:24 +02:00
Yacine Elhamer
1029b369f2
Merge remote-tracking branch 'parentrepo/dynamic-feature-extraction' into find-dynamic-capabilities
2023-07-20 20:02:49 +01:00
Yacine Elhamer
e3f60ea0fb
initial commit
2023-07-17 11:50:49 +01:00
Willi Ballenthin
c86ab51210
fix copyright headers everywhere
2023-07-13 05:03:33 +02:00
Aayush Goel
ef39bc3c3a
Merged Changes from PR #1591
2023-07-11 01:14:38 +05:30
Aayush Goel
8e346cb411
Merge branch 'Aayush-Goel-04/Issue#1534' of https://github.com/Aayush-Goel-04/capa into Aayush-Goel-04/Issue#1534
2023-07-11 00:59:21 +05:30
Aayush Goel
673af45c55
Update args.sample type to Path and str vs as_posix comparisons
2023-07-09 16:02:28 +05:30
Aayush Goel
edeb458b33
some more changes
2023-07-07 12:03:05 +05:30
Willi Ballenthin
13a8e252f0
introduce flake8-comprehensions
2023-07-06 20:04:27 +02:00
Willi Ballenthin
9441da4887
isort
2023-07-06 17:50:34 +02:00
Willi Ballenthin
47074fd129
fix ruff issues
2023-07-06 17:49:40 +02:00
Aayush Goel
c0d712acea
Changes os.path to pathlib.Path usage
...
changed args.rules , args.signatures types in handle_common_args.
2023-07-06 05:12:50 +05:30
Aayush Goel
b4870b120e
Remove from_capa API for MetaData
2023-06-03 15:33:49 +05:30
Aayush Goel
445214b23b
Update Metadata type in capa main
2023-06-02 00:40:38 +05:30
Willi Ballenthin
f1c495dc0a
*: use FORMAT_AUTO instead of string literal
2023-03-21 16:54:48 +01:00
Willi Ballenthin
1f3582c9c3
mypy
2023-03-21 16:45:24 +01:00
manasghandat
1336796c0c
code style : update remaining files ( #1353 )
...
* code style: update string formatting using fstrings
---------
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
Co-authored-by: Moritz <mr-tz@users.noreply.github.com >
2023-03-16 11:16:18 +01:00
Moritz
6a222a6139
Update black ( #1307 )
...
* build(deps-dev): bump black from 22.12.0 to 23.1.0
Bumps [black](https://github.com/psf/black ) from 22.12.0 to 23.1.0.
- [Release notes](https://github.com/psf/black/releases )
- [Changelog](https://github.com/psf/black/blob/main/CHANGES.md )
- [Commits](https://github.com/psf/black/compare/22.12.0...23.1.0 )
---
updated-dependencies:
- dependency-name: black
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
* reformat black 23.1.0
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-02-07 15:50:15 +01:00
Willi Ballenthin
67cfefd2df
main: get_rules: remove progress bar
2023-01-21 19:38:23 +01:00
Willi Ballenthin
476ffabae9
rules: cache the ruleset to disk
...
ref: #1212
2023-01-20 14:50:00 +01:00
Josh Soref
68efa7316b
spelling: dictionary
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2023-01-04 00:25:22 -05:00
Willi Ballenthin
b819033da0
lots of mypy
2022-12-14 10:37:39 +01:00
Willi Ballenthin
e7cf69a82e
pep8
2022-06-28 15:58:02 -06:00
Willi Ballenthin
91818a116d
scripts/capa_as_library: use new ResultDocument
...
closes #1071
2022-06-28 15:53:37 -06:00
Willi Ballenthin
aff72ad983
capa_as_library: fix rules path is list now
2022-04-06 11:07:34 -06:00
re-fox
37f51690d0
Update capa_as_library.py
2022-02-13 13:09:58 -05:00
William Ballenthin
4451b76f89
pep8
2021-10-26 15:21:28 -06:00
William Ballenthin
328e13fbfe
main: compute function & bb layout
...
so bb can be associated with function in output.
only captures BBs that have a rule match,
otherwise, there might be too much data captured.
closes #130 .
2021-10-26 15:04:50 -06:00
William Ballenthin
1b9a6c3c59
main: collect os/format/arch into metadata and render it
2021-08-20 16:50:40 -06:00
doomedraven
b1171864e3
black
2021-08-18 14:25:58 +02:00
doomedraven
5af59cecda
update capa_as_library for capa v2
2021-08-18 14:23:36 +02:00
William Ballenthin
a7ebd5a309
Merge branch 'master' of github.com:fireeye/capa into fix-507
2021-06-15 12:28:17 -06:00
William Ballenthin
7f03db9fe4
main: dont save .viv by default, unless CAPA_SAVE_WORKSPACE set
...
closes #507
2021-06-15 12:24:01 -06:00
William Ballenthin
aca6ad2f52
scripts: fix types
2021-06-14 10:41:44 -06:00
William Ballenthin
ac59e50b5f
move capa/features/__init__.py logic to common.py
...
also cleanup imports across the board,
thanks to pylance.
2021-06-09 22:20:53 -06:00
William Ballenthin
766dcacdbe
move logic out of capa/render/__init__.py
2021-06-09 18:06:51 -06:00
William Ballenthin
1ee7b7b856
merge master
2021-03-05 15:23:47 -07:00
William Ballenthin
eacd70329a
merge from master, sorry
2021-03-05 11:06:40 -07:00
William Ballenthin
3a1d5d068c
scripts: use common argument handler
...
closes #449
2021-03-05 10:58:40 -07:00
William Ballenthin
c2a4629c62
scripts: add cli arguments to specify signatures
2021-03-04 15:04:33 -07:00
Ana Maria Martinez Gomez
40ed2f39a4
Make backend a required parameter in get_extractor
...
Make the `backend` argument required in the `get_extractor` internal
routine. Specify a backend in the scripts which call this function. Add
a CLI backend option in capa/features/freeze.py as well.
2021-03-03 17:36:50 +01:00
Ana Maria Martinez Gomez
d28ba3c628
Make backend a required parameter in get_extractor
...
Make the `backend` argument required in the `get_extractor` internal
routine. Specify a backend in the scripts which call this function. Add
a CLI backend option in capa/features/freeze.py as well.
2021-02-25 10:04:19 +01:00
DoomedRaven
e158e3f13c
remove type hint to make CI happy
2020-12-08 21:46:39 +01:00
DoomedRaven
b1bbded23c
black -l 120 .
2020-12-08 21:39:50 +01:00
DoomedRaven
b77d9d3738
isort --profile black --length-sort --line-width 120 capa_as_library.py
2020-12-08 21:34:42 +01:00
DoomedRaven
d0b2421752
isort capa_as_library.py
2020-12-08 20:53:26 +01:00
DoomedRaven
96b65a7c60
add example how to render it as library
...
```
>>> from capa_as_library import capa_details
>>> details = capa_details("/opt/CAPEv2/storage/analyses/83/binary", "dictionary")
>>> from pprint import pprint as pp
>>> pp(details)
{'ATTCK': {'DEFENSE EVASION': ['Obfuscated Files or Information [T1027]',
'Virtualization/Sandbox Evasion::System Checks '
'[T1497.001]'],
'EXECUTION': ['Shared Modules [T1129]']},
'CAPABILITY': {'anti-analysis/anti-vm/vm-detection': ['execute anti-VM '
'instructions (3 '
'matches)'],
'anti-analysis/obfuscation/string/stackstring': ['contain '
'obfuscated '
'stackstrings'],
'data-manipulation/encryption/rc4': ['encrypt data using RC4 '
'PRGA'],
'executable/pe/section/rsrc': ['contain a resource (.rsrc) '
'section'],
'host-interaction/cli': ['accept command line arguments'],
'host-interaction/environment-variable': ['query environment '
'variable'],
'host-interaction/file-system/read': ['read .ini file',
'read file'],
'host-interaction/file-system/write': ['write file (3 '
'matches)'],
'host-interaction/process': ['get thread local storage value '
'(3 matches)',
'set thread local storage value '
'(2 matches)'],
'host-interaction/process/terminate': ['terminate process (3 '
'matches)'],
'host-interaction/thread/terminate': ['terminate thread'],
'linking/runtime-linking': ['link function at runtime (7 '
'matches)',
'link many functions at runtime'],
'load-code/pe': ['parse PE header (3 matches)']},
'MBC': {'ANTI-BEHAVIORAL ANALYSIS': ['Virtual Machine Detection::Instruction '
'Testing [B0009.029]'],
'ANTI-STATIC ANALYSIS': ['Disassembler Evasion::Argument Obfuscation '
'[B0012.001]'],
'CRYPTOGRAPHY': ['Encrypt Data::RC4 [C0027.009]',
'Generate Pseudo-random Sequence::RC4 PRGA '
'[C0021.004]']},
'md5': 'ad56c384476a81faef9aebd60b2f4623',
'path': '/opt/CAPEv2/storage/analyses/83/binary',
'sha1': 'aa027d89f5d3f991ad3e14ffb681616a77621836',
'sha256': '16995e059eb47de0b58a95ce2c3d863d964a7a16064d4298cee9db1de266e68d'}
>>>
```
2020-12-08 20:00:24 +01:00
doomedraven
5920552649
small improvements
2020-12-01 20:31:56 +01:00
