Moritz
|
d210645aee
|
fix: api handling workaround (#1079)
* fix: api handling workaround
* fix: workaround .NET api handling
|
2022-07-01 17:37:56 +02:00 |
|
Willi Ballenthin
|
91818a116d
|
scripts/capa_as_library: use new ResultDocument
closes #1071
|
2022-06-28 15:53:37 -06:00 |
|
Willi Ballenthin
|
9236a36ef4
|
rule: factor out is subscope check
|
2022-05-26 10:24:31 -06:00 |
|
Moritz
|
65552575f8
|
Update dotnet-main (#979)
* Sync capa rules submodule
* Sync capa-testfiles submodule
* Sync capa rules submodule
* changelog
* *: remove /x32 and /x64 flavors from number and offset features
* *: remove more references to /x32 and /x64
* linter: accept instruction scope
* rules: fix max operand index (4)
* API: better support A/W functions
* vverbose: show lib rule matches
* main: accept multiple paths to rules
* main: fix removal of default rules path
* lint: fix rules path
* changelog
* capa_as_library: fix rules path is list now
* main: better handle multiple rules paths
* main: bail if python 3.6 or below
closes #964
* ida: readme: remove python 3.6 support
* capa2yara: fix rules paths
* render: meta: display rule paths on separate lines
closes #971
* render: verbose: add doc
* verbose: make rule path multiline more concise
* vverbose: don't show examples in output
closes #970
* vverbose: render subscope name, like "basic block:"
closes #963
* build(deps-dev): bump pytest from 7.0.1 to 7.1.1
Bumps [pytest](https://github.com/pytest-dev/pytest) from 7.0.1 to 7.1.1.
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pytest-dev/pytest/compare/7.0.1...7.1.1)
---
updated-dependencies:
- dependency-name: pytest
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
* ci: build: update pip and setuptools
* ci: build: bump pyinstall to v4.10
* Sync capa rules submodule
* Dotnet mixed mode detect (#969)
* feat: start dotnet detection (#955)
* feat: start dotnet detection
* Apply suggestions from code review
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
* refactor: dn instead of dotnet
* refactor: format branches, extractor reorg
* refactor: format selection and dotnet detect
* feat: get format, arch, os
* refactor: log errors and exceptions
* ci: also test and build for dotnet-main dev
* fix: import path
* fix: circular dep
* fix: remove buf argument
feat: get runtime meta data
* fix: log unsupported runtime error
* fix: type ignore
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
* fix: imports and add tests
* feat: detect mixed mode and tests
* feat: start dotnet detection (#955)
* feat: start dotnet detection
* Apply suggestions from code review
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
* refactor: dn instead of dotnet
* refactor: format branches, extractor reorg
* refactor: format selection and dotnet detect
* feat: get format, arch, os
* refactor: log errors and exceptions
* ci: also test and build for dotnet-main dev
* fix: import path
* fix: circular dep
* fix: remove buf argument
feat: get runtime meta data
* fix: log unsupported runtime error
* fix: type ignore
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
* fix: imports and add tests
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
* test: checkout submodules recursively
Co-authored-by: Capa Bot <capa-dev@mandiant.com>
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
|
2022-04-07 17:45:29 +02:00 |
|
Willi Ballenthin
|
963cfbf380
|
pep8
|
2022-03-28 13:17:35 -06:00 |
|
Moritz Raabe
|
8de69c639a
|
s/fireeye/mandiant
|
2021-09-29 12:55:16 +02:00 |
|
William Ballenthin
|
ab1326f858
|
features: move OS and Format to their own features, not characteristics
|
2021-08-16 16:28:26 -06:00 |
|
William Ballenthin
|
ac59e50b5f
|
move capa/features/__init__.py logic to common.py
also cleanup imports across the board,
thanks to pylance.
|
2021-06-09 22:20:53 -06:00 |
|
Arnim Rupp
|
7759d2dd79
|
Update capa2yara.py
|
2021-05-21 17:04:16 +02:00 |
|
Arnim Rupp
|
73f121cf03
|
Update capa2yara.py
bugfix: https://github.com/fireeye/capa-rules/blob/master/collection/get-geographical-location.yml hit an far too many files with /\bcity opposed to the intention of the capa rule ti just hit in function names. changed to /\x00city.
|
2021-05-21 16:51:14 +02:00 |
|
Arnim Rupp
|
7b62b589f7
|
Create capa2yara.py (#561)
* Create capa2yara.py
* Update capa2yara.py
isort --profile black --length-sort --line-width 120
black -l 120
* Update scripts/capa2yara.py
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
Co-authored-by: Arnim Rupp <46819580+2d4d@users.noreply.github.com>
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
|
2021-05-19 18:01:04 +02:00 |
|