Commit Graph

5232 Commits

Author SHA1 Message Date
Moritz
e71f90c618 dos2unix (#2330) 2024-08-26 12:22:06 +02:00
Fariss
a779cf2a28 cli: add note about capa explorer web to CLI help text (#2329)
* cli: add note about capa explorer web to CLI help text

---------

Co-authored-by: Willi Ballenthin <wballenthin@google.com>
2024-08-26 09:22:55 +02:00
Moritz
a5c14c32b8 Merge pull request #2312 from s-ff/edit-explorer-landing-page
Edit explorer landing page
2024-08-23 17:30:38 +02:00
Fariss
88a632c2d4 Update web/explorer/README.md
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
2024-08-23 17:21:12 +02:00
Fariss
89443742cd Update web/explorer/README.md
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
2024-08-23 17:21:06 +02:00
Soufiane Fariss
1ffee81cea introduce getting started step to explorer landing page 2024-08-23 17:13:43 +02:00
Willi Ballenthin
6c883f37a8 add .justfile (#2325) 2024-08-22 13:25:53 +02:00
Moritz
dcc74eb07a Merge pull request #2326 from mandiant/williballenthin-patch-1
readme: add quick links to header
2024-08-22 13:25:06 +02:00
Moritz
0a6bc20eed Merge pull request #2324 from williballenthin/fix/2323
rules: deduplicate API features with stripped DLL
2024-08-22 13:22:05 +02:00
dependabot[bot]
df3c265bd5 build(deps): bump deptry from 0.17.0 to 0.19.1 (#2303)
Bumps [deptry](https://github.com/fpgmaas/deptry) from 0.17.0 to 0.19.1.
- [Release notes](https://github.com/fpgmaas/deptry/releases)
- [Changelog](https://github.com/fpgmaas/deptry/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fpgmaas/deptry/compare/0.17.0...0.19.1)

---
updated-dependencies:
- dependency-name: deptry
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
Co-authored-by: Willi Ballenthin <wballenthin@google.com>
2024-08-22 13:18:19 +02:00
dependabot[bot]
73120a5c0b build(deps): bump humanize from 4.9.0 to 4.10.0 (#2304)
Bumps [humanize](https://github.com/python-humanize/humanize) from 4.9.0 to 4.10.0.
- [Release notes](https://github.com/python-humanize/humanize/releases)
- [Commits](https://github.com/python-humanize/humanize/compare/4.9.0...4.10.0)

---
updated-dependencies:
- dependency-name: humanize
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-22 13:16:45 +02:00
dependabot[bot]
a0ed2127f9 build(deps): bump flake8 from 7.1.0 to 7.1.1 (#2306)
Bumps [flake8](https://github.com/pycqa/flake8) from 7.1.0 to 7.1.1.
- [Commits](https://github.com/pycqa/flake8/compare/7.1.0...7.1.1)

---
updated-dependencies:
- dependency-name: flake8
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-22 13:16:36 +02:00
Willi Ballenthin
4df8b2b7ed readme: add quick links to header
closes #2321
2024-08-22 13:11:07 +02:00
Willi Ballenthin
68a38b6e6f rules: deduplicate API features with stripped DLL
closes #2323
2024-08-22 10:34:53 +00:00
Willi Ballenthin
a33f67b48e add landing page and rules website (#2310)
* web: index: add gif of capa running

* index: add screencast of running capa

produced via:

```
asciinema capa.cast
./capa Practical\ Malware\ Analysis\ Lab\ 01-01.dll_
<ctrl-d>
agg --no-loop --theme solarized-light capa.cast capa.gif
```

* web: index: start to sketch out style

* web: landing page

* web: merge rules website

* web: rules: update bootstrap and integrate rules

* web: rules: use pygments to syntax highlight rules

Use the Pygments syntax-highlighting library to parse
and render the YAML rule content. This way we don't have
to manually traverse the rule nodes and emit lists; instead,
we rely on the fact that YAML is pretty easy for humans
to read and let them consume it directly, with some text 
formatting to help hint at the types/structure.

* web: rules: use capa to load rule content

capa (the library) has routines for deserializing the YAML
content into structured objects, which means we can use tools
like mypy to find bugs. So, prefer to use those routines instead
of parsing YAML ourselves.

* web: rules: linters

Run and fix the issues identified by the following linters:

  - isort
  - black
  - ruff
  - mypy

* web: rules: add some links to rule page

Add links to the following external resources:

  - GitHub rule source in capa-rules repo
  - VirusTotal search for matching samples

* web: rules: accept ?q= parameter for initial search

Update the rules landing page to accept a HTTP
query parameter named "q" that specifies an initial 
search term to to pass to pagefind. This enables
external pages link to rule searches.

* web: rules: add link to namespace search

* web: rules: use consistent header

Import header from root capa landing page.

* web: rules: add umami script

* web: add initial whats new section, TODOs

* web: rules: remove old images

* changelog

* CI: remove temporary branch push event triggers

* Delete web/rules/public/css/bootstrap-4.5.2.min.css

* Delete web/rules/public/js/bootstrap-4.5.2.min.js

* Delete web/public/img/capa.cast

* Rename readme.md to README.md

* web: rules: add scripts to pre-commit configs

* web: rules: add scripts to pre-commit configs

* lints

* ci: add temporary branch push trigger to get incremental builds

* web: rules: assert start_dir must exist

* ci: web: rules: deep checkout so we can get rule history

* web: rules: check output of subprocess

* web: rules: factor out common CSS

* web: rules: fix header links

* web: rules: only index rule content, not surrounding text

* ci: web: remote temporary branch push trigger
2024-08-22 09:42:40 +02:00
Soufiane Fariss
f2ed09861e web: modify theming and add info to landing page 2024-08-21 18:49:26 +02:00
Soufiane Fariss
5b583bdf35 edit main README.md 2024-08-21 18:36:25 +02:00
Soufiane Fariss
9959eb6bae web: edit explorer README 2024-08-21 18:33:58 +02:00
Fariss
c3f24c2f48 Merge pull request #2301 from s-ff/use-gzipped-preview
web: don't bundle preview data in build and release
2024-08-21 18:06:28 +02:00
Fariss
2c41d3ce89 Merge branch 'master' into use-gzipped-preview 2024-08-21 18:05:05 +02:00
Fariss
980814f7df update code comment
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
2024-08-21 16:24:58 +02:00
Soufiane Fariss
6049062173 fix: typo Preview Dynamic 2024-08-21 11:05:21 +02:00
Soufiane Fariss
05083cfb6e refactor and optimize parseRules routine 2024-08-21 11:05:21 +02:00
Soufiane Fariss
0bdfb37287 use monospace font for match location nodes 2024-08-21 11:05:21 +02:00
Soufiane Fariss
5f5393af69 dynamic: disable process column and collapse pid into process 2024-08-21 11:05:21 +02:00
Soufiane Fariss
5c1c1b0ba9 remove default option scrollable and minify text 2024-08-21 11:05:21 +02:00
Soufiane Fariss
8fd90883b4 web: refactor and add support for laoding remote .gz using rdoc query param 2024-08-21 11:05:21 +02:00
Willi Ballenthin
22d20ed2b8 web: add umami script for collecting metrics (#2308) 2024-08-20 22:53:01 +02:00
Moritz
b3dd76adff Merge branch 'master' into use-gzipped-preview 2024-08-20 20:25:29 +02:00
Yacine
f6b7582606 bump to v7.2.0 (#2297)
* update CHANGELOG.md and version.py

---------

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
v7.2.0
2024-08-20 20:12:46 +02:00
Yacine
791f5e2359 Add the ability to select which functions or processes you which to extract capabilities from (#2156) 2024-08-20 14:09:46 +02:00
Soufiane Fariss
c4c35e914d fix lint 2024-08-19 17:19:57 +02:00
Soufiane Fariss
1593779d6b use preview buttons as redirect to static URLs 2024-08-19 17:17:07 +02:00
Soufiane Fariss
5c6faaefff relax version down to 6.1.0 2024-08-19 17:17:07 +02:00
Soufiane Fariss
864cd77f9f remove loading function for preview data 2024-08-19 17:17:07 +02:00
Soufiane Fariss
164e075ca9 fix preview data placeholders 2024-08-19 15:51:06 +02:00
Soufiane Fariss
7592cfe268 don't include preview files in bundle mode 2024-08-19 15:22:12 +02:00
Soufiane Fariss
6a2039e7a6 bump max matches in dynamic mode to 25 matches per rule 2024-08-19 15:21:38 +02:00
Soufiane Fariss
0e4872507d process gzipped files 2024-08-19 15:20:27 +02:00
Soufiane Fariss
dd6cb4acc3 declare gzip files as static assets in vite.config.js 2024-08-19 15:19:30 +02:00
Soufiane Fariss
7e766048fa remove preview buttons in release mode 2024-08-19 15:13:02 +02:00
Soufiane Fariss
7c26490caa remove download button in release mode 2024-08-19 15:12:33 +02:00
Moritz
c409b2b7ed Merge pull request #2300 from s-ff/add-file-scope-rules 2024-08-17 09:09:08 +02:00
Soufiane Fariss
4501955728 remove octal repr for hex values 2024-08-16 23:37:30 +02:00
Capa Bot
6b4591de14 Sync capa rules submodule 2024-08-16 18:57:36 +00:00
Soufiane Fariss
00cce585d6 remove sorting from columns 2024-08-16 18:52:53 +02:00
Soufiane Fariss
19e2097f79 change placeholder text 2024-08-16 18:52:02 +02:00
Soufiane Fariss
b67bd4d084 add file-level rules to capabilities by function 2024-08-16 18:23:44 +02:00
Soufiane Fariss
854759cb43 add tooltip to show decimal/octal rep 2024-08-16 18:17:34 +02:00
Moritz
348e0b3203 Merge pull request #2299 from s-ff/issue/2236
web: add copy rule name and description to VT to right click menu
2024-08-16 17:21:31 +02:00