Commit Graph

918 Commits

Author SHA1 Message Date
Capa Bot
e6d75ee7c4 Sync capa rules submodule 2020-10-23 16:46:53 +00:00
Moritz
61986fc98c Merge pull request #333 from fireeye/improve-packaging-setup
add long description and other improvements
2020-10-23 13:16:13 +02:00
Moritz
0e009c7c12 Merge pull request #347 from fireeye/fix/non-ascii-char-filename
get decoded sample path
2020-10-23 13:15:36 +02:00
Moritz
425613ee42 Merge pull request #346 from fireeye/extract/api-jmps
Extract/api jmps
2020-10-23 13:15:10 +02:00
Moritz Raabe
679316946e addressing Willi's feedback 2020-10-22 20:10:47 +02:00
Moritz
8bb305038b Merge pull request #343 from fireeye/fix/file-imports-ordinal-name
extract ordinal and name imports
2020-10-22 20:07:42 +02:00
Moritz Raabe
fbe104d254 get decoded sample path
closes #328
2020-10-22 19:56:41 +02:00
Capa Bot
cb44cb0ee2 Sync capa-testfiles submodule 2020-10-22 17:49:54 +00:00
Capa Bot
2163f64877 Sync capa-testfiles submodule 2020-10-22 17:49:18 +00:00
Capa Bot
a14d958ef0 Sync capa-testfiles submodule 2020-10-22 13:17:55 +00:00
Capa Bot
c65ef12783 Sync capa rules submodule 2020-10-22 04:02:25 +00:00
Capa Bot
8eb1727c76 Sync capa rules submodule 2020-10-21 15:54:41 +00:00
William Ballenthin
fafe24295a Merge branch 'master' of github.com:fireeye/capa 2020-10-21 09:53:09 -06:00
William Ballenthin
d900a6c145 render: default: sanity check MBC 2020-10-21 09:52:40 -06:00
Capa Bot
03df2fa3e9 Sync capa rules submodule 2020-10-21 15:43:31 +00:00
Moritz Raabe
69a4b99d70 extract apis called via jmp
closes #337
2020-10-21 12:39:45 +02:00
Capa Bot
39d95b2fd2 Sync capa rules submodule 2020-10-21 10:21:54 +00:00
Moritz Raabe
1e3b29de2e add IDA specific test 2020-10-21 12:16:50 +02:00
Moritz
d5186f160d Merge pull request #342 from fireeye/viv/extractor/api-thunk-chains
extract api features for thunk chains
2020-10-21 11:37:58 +02:00
Capa Bot
5d7dbd15c7 Sync capa-testfiles submodule 2020-10-21 09:35:22 +00:00
Moritz Raabe
12d5fe0afe addressing feedback 2020-10-21 11:25:08 +02:00
Capa Bot
3df1cc9038 Sync capa rules submodule 2020-10-20 21:04:10 +00:00
Willi Ballenthin
d46152b73e Merge pull request #345 from fireeye/fix/build-workflow-set-env-var
set env var via environment file
2020-10-20 09:55:26 -06:00
Moritz Raabe
9fc6e0d6a2 Merge branch 'enhance/show-features' into viv/extractor/api-thunk-chains 2020-10-20 15:26:51 +02:00
Moritz Raabe
4994d0597f set env var via environment file 2020-10-20 15:14:36 +02:00
Moritz Raabe
76b46d7957 ensure function is defined in vivisect (or do so)
and show features in IDA
2020-10-20 15:09:07 +02:00
Moritz Raabe
0a369c548b extract ordinal and name imports 2020-10-20 14:56:38 +02:00
Moritz Raabe
9a738ba413 extract api features for thunk chains
closes #341
2020-10-20 14:49:09 +02:00
Moritz
a442536246 Merge pull request #340 from fireeye/ida/extractor/improve-api-thunk-detection
ida/extractor: improve detection of APIs called via two or more chained thunks
2020-10-19 20:51:16 +02:00
Capa Bot
f85b6fde7b Sync capa rules submodule 2020-10-16 16:05:56 +00:00
Capa Bot
8dc6a5109a Sync capa-testfiles submodule 2020-10-15 21:00:58 +00:00
Michael Hunhoff
235d9d4ab5 improve detection of APIs called via two or more chained thunks 2020-10-15 14:31:23 -06:00
Capa Bot
3572de058b Sync capa rules submodule 2020-10-08 18:16:59 +00:00
Capa Bot
93068aff1b Sync capa-testfiles submodule 2020-10-08 18:16:15 +00:00
Capa Bot
49e7d75ce5 Sync capa rules submodule 2020-10-08 15:53:20 +00:00
Capa Bot
6aa1ecd1a8 Sync capa-testfiles submodule 2020-10-08 15:52:23 +00:00
Capa Bot
b442fbb19c Sync capa rules submodule 2020-10-07 20:58:02 +00:00
Capa Bot
46fc4f0c25 Sync capa-testfiles submodule 2020-10-07 20:57:34 +00:00
Capa Bot
155de6f2b9 Sync capa rules submodule 2020-10-06 16:30:56 +00:00
Capa Bot
459af7ab1b Sync capa rules submodule 2020-10-06 02:36:03 +00:00
Willi Ballenthin
2bd408a274 Merge pull request #338 from fireeye/fix/feature-str
fix feature display
2020-10-05 14:19:54 -06:00
Moritz Raabe
bc1c5a59f8 display value including 0 2020-10-05 22:10:04 +02:00
Willi Ballenthin
49cecdc75d Merge pull request #336 from fireeye/fix-335
modify find_byte_sequence to yield all locations
2020-10-05 11:02:36 -06:00
Capa Bot
2a6aeae763 Sync capa rules submodule 2020-10-05 17:02:21 +00:00
Michael Hunhoff
f295e1da31 modify find_byte_sequence to yield all locations, instead of only first 2020-10-05 10:27:45 -06:00
Capa Bot
1981859343 Sync capa rules submodule 2020-10-05 16:11:30 +00:00
Capa Bot
9de237e1a3 Sync capa-testfiles submodule 2020-10-05 14:18:32 +00:00
Moritz Raabe
77b412c1e8 add long description and other improvements 2020-10-02 17:08:03 +02:00
Moritz
a31529bb79 Merge pull request #332 from fireeye/render-mbc
render mbc table
2020-10-02 11:09:39 +02:00
Moritz Raabe
00bc1a169e render mbc table 2020-10-01 11:10:03 +02:00