diff --git a/.github/workflows/web-deploy.yml b/.github/workflows/web-deploy.yml index a2325899d..fc103c933 100644 --- a/.github/workflows/web-deploy.yml +++ b/.github/workflows/web-deploy.yml @@ -33,7 +33,7 @@ jobs: path: './web/public' build-explorer: - name: Build capa explorer web + name: Build capa Explorer Web runs-on: ubuntu-latest steps: - name: Checkout diff --git a/CHANGELOG.md b/CHANGELOG.md index d3cdd65b0..8e5ec4041 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -18,13 +18,15 @@ Unlock powerful malware analysis with capa's new [VMRay sandbox](https://www.vmr ### Breaking Changes -### New Rules (0) +### New Rules (1) +- linking/static/minhook/linked-against-minhook jakub.jozwiak@mandiant.com - ### Bug Fixes - fix duplicate features shown in vverbose mode @williballenthin #2323 +- fix code path reference in linter @williballenthin #2350 ### capa explorer IDA Pro plugin diff --git a/README.md b/README.md index 3a987b7d5..52dae8368 100644 --- a/README.md +++ b/README.md @@ -28,7 +28,7 @@ capa detects capabilities in executable files. You run it against a PE, ELF, .NET module, shellcode file, or a sandbox report and it tells you what it thinks the program can do. For example, it might suggest that the file is a backdoor, is capable of installing services, or relies on HTTP to communicate. -To interactively inspect capa results in your browser use the [capa explorer web](https://mandiant.github.io/capa/explorer/). +To interactively inspect capa results in your browser use the [capa Explorer Web](https://mandiant.github.io/capa/explorer/). If you want to inspect or write capa rules, head on over to the [capa-rules repository](https://github.com/mandiant/capa-rules). Otherwise, keep reading. @@ -89,12 +89,12 @@ Download stable releases of the standalone capa binaries [here](https://github.c To use capa as a library or integrate with another tool, see [doc/installation.md](https://github.com/mandiant/capa/blob/master/doc/installation.md) for further setup instructions. -# capa explorer web -The [capa explorer web](https://mandiant.github.io/capa/explorer/) enables you to interactively explore capa results in your web browser. Besides the online version you can download a standalone HTML file for local offline usage. +# capa Explorer Web +The [capa Explorer Web](https://mandiant.github.io/capa/explorer/) enables you to interactively explore capa results in your web browser. Besides the online version you can download a standalone HTML file for local offline usage. -![capa explorer web screenshot](https://github.com/mandiant/capa/blob/master/doc/img/capa_web_explorer.png) +![capa Explorer Web screenshot](https://github.com/mandiant/capa/blob/master/doc/img/capa_web_explorer.png) -More details on the web UI is available in the [capa explorer web README](https://github.com/mandiant/capa/blob/master/web/explorer/README.md). +More details on the web UI is available in the [capa Explorer Web README](https://github.com/mandiant/capa/blob/master/web/explorer/README.md). # example diff --git a/capa/helpers.py b/capa/helpers.py index 7d1056ea7..237a67f62 100644 --- a/capa/helpers.py +++ b/capa/helpers.py @@ -355,7 +355,11 @@ def is_cache_newer_than_rule_code(cache_dir: Path) -> bool: cache_timestamp = os.path.getmtime(latest_cache_file) # these are the relevant rules code files that could conflict with using an outdated cache - latest_rule_code_file = max([Path("capa/rules/__init__.py"), Path("capa/rules/cache.py")], key=os.path.getmtime) + # delayed import due to circular dependencies + import capa.rules + import capa.rules.cache + + latest_rule_code_file = max([Path(capa.rules.__file__), Path(capa.rules.cache.__file__)], key=os.path.getmtime) rule_code_timestamp = os.path.getmtime(latest_rule_code_file) if rule_code_timestamp > cache_timestamp: diff --git a/capa/main.py b/capa/main.py index 3166bc789..8035eafa2 100644 --- a/capa/main.py +++ b/capa/main.py @@ -903,7 +903,7 @@ def main(argv: Optional[List[str]] = None): You can see the rule set here: https://github.com/mandiant/capa-rules - You can load capa JSON output to capa explorer web: + You can load capa JSON output to capa Explorer Web: https://github.com/mandiant/capa/explorer To provide your own rule set, use the `-r` flag: diff --git a/requirements.txt b/requirements.txt index e1e41ecde..de1ca3540 100644 --- a/requirements.txt +++ b/requirements.txt @@ -8,7 +8,7 @@ # Kept up to date by dependabot. annotated-types==0.7.0 colorama==0.4.6 -cxxfilt==0.2.2 +cxxfilt==0.3.0 dncil==1.0.2 dnfile==0.15.0 funcy==2.0 @@ -23,8 +23,8 @@ networkx==3.1 pefile==2023.2.7 pip==24.2 protobuf==5.27.3 -pyasn1==0.4.8 -pyasn1-modules==0.2.8 +pyasn1==0.5.1 +pyasn1-modules==0.3.0 pycparser==2.22 pydantic==2.7.3 pydantic-core==2.18.4 @@ -43,5 +43,5 @@ tabulate==0.9.0 termcolor==2.4.0 tqdm==4.66.5 viv-utils==0.7.11 -vivisect==1.1.1 +vivisect==1.2.1 wcwidth==0.2.13 diff --git a/rules b/rules index 5b8c8a63a..4cc01222c 160000 --- a/rules +++ b/rules @@ -1 +1 @@ -Subproject commit 5b8c8a63a29c4fed88078278e7f8c8fdfbad709a +Subproject commit 4cc01222c50e591ce3ee2d4a8917f9f357041f1d diff --git a/web/explorer/.prettierrc.json b/web/explorer/.prettierrc.json index 376c2bf76..1987e0029 100644 --- a/web/explorer/.prettierrc.json +++ b/web/explorer/.prettierrc.json @@ -4,5 +4,6 @@ "tabWidth": 4, "singleQuote": false, "printWidth": 120, - "trailingComma": "none" + "trailingComma": "none", + "htmlWhitespaceSensitivity": "ignore" } diff --git a/web/explorer/DEVELOPMENT.md b/web/explorer/DEVELOPMENT.md index e9b15709c..b26abdc2b 100644 --- a/web/explorer/DEVELOPMENT.md +++ b/web/explorer/DEVELOPMENT.md @@ -1,6 +1,6 @@ -# Development Guide for capa explorer web +# Development Guide for capa Explorer Web -This guide will help you set up the capa explorer web project for local development. +This guide will help you set up the capa Explorer Web project for local development. ## Prerequisites @@ -104,7 +104,7 @@ npm run format ## Working with PrimeVue Components -capa explorer web uses the PrimeVue UI component library. When adding new features or modifying existing ones, refer to the [PrimeVue documentation](https://primevue.org/vite) for available components and their usage. +capa Explorer Web uses the PrimeVue UI component library. When adding new features or modifying existing ones, refer to the [PrimeVue documentation](https://primevue.org/vite) for available components and their usage. ## Best Practices diff --git a/web/explorer/README.md b/web/explorer/README.md index b616c181c..e592ef554 100644 --- a/web/explorer/README.md +++ b/web/explorer/README.md @@ -1,6 +1,6 @@ -# capa explorer web +# capa Explorer Web -capa explorer web is a browser-based user interface for exploring program capabilities identified by capa. It provides an intuitive and interactive way to analyze and visualize the results of capa analysis. +capa Explorer Web is a browser-based user interface for exploring program capabilities identified by capa. It provides an intuitive and interactive way to analyze and visualize the results of capa analysis. ## Features @@ -11,13 +11,13 @@ capa explorer web is a browser-based user interface for exploring program capabi ## Getting Started -1. **Access the application**: Open capa explorer web in your web browser. - You can start using capa explorer web by accessing [https://mandiant.github.io/capa](https://mandiant.github.io/capa/explorer) or running it locally by downloading the offline release from the top right-hand corner and opening it in your web browser. +1. **Access the application**: Open capa Explorer Web in your web browser. + You can start using capa Explorer Web by accessing [https://mandiant.github.io/capa](https://mandiant.github.io/capa/explorer) or running it locally by downloading the offline release from the top right-hand corner and opening it in your web browser. 2. **Import capa results**: - Click on "Upload from local" to select a capa analysis document file from your computer (with a version higher than 7.0.0). - - You can generate the analysis document by running `capa.exe -j results.json sample.exe_` + - You can generate the analysis document by running `capa.exe -j results.json sample.exe_` - Or, paste a URL to a capa JSON file and click the arrow button to load it. - Like for the other import mechanisms, loading of both plain (`.json`) and GZIP compressed JSON (`.json.gz`) files is supported). - Alternatively, use the "Preview Static" or "Preview Dynamic" for sample data. @@ -41,4 +41,4 @@ We welcome your feedback and contributions to improve the web-based capa explore --- -For developers interested in building or contributing to capa explorer web, please refer to our [Development Guide](DEVELOPMENT.md). +For developers interested in building or contributing to capa Explorer Web, please refer to our [Development Guide](DEVELOPMENT.md). diff --git a/web/explorer/index.html b/web/explorer/index.html index 3330f702a..b88355943 100644 --- a/web/explorer/index.html +++ b/web/explorer/index.html @@ -4,8 +4,12 @@ - capa explorer web - + capa Explorer Web +
diff --git a/web/explorer/src/components/BannerHeader.vue b/web/explorer/src/components/BannerHeader.vue index 9d4e10cfb..11e5d8d4f 100644 --- a/web/explorer/src/components/BannerHeader.vue +++ b/web/explorer/src/components/BannerHeader.vue @@ -5,7 +5,7 @@ >
This is an early release

- capa explorer web is a web-based tool for exploring the capabilities identified in a program. It can be - used to search and display the rule matches in different viewing modes. + capa Explorer Web is a web-based tool to explore the capabilities identified by capa. This tool allows + you to interactively browse and display capa results in multiple viewing modes.

New to capa? Follow these quick steps to get started:

    -
  1. Install capa: pip install flare-capa
    2. -
  2. Generate JSON output: capa -j /path/to/file > result.json
    3. -
  3. Upload the JSON file here to explore the results
    4. +
  4. + + Install capa + + , e.g. + +
    5. +
  5. + Analyze a sample and save the JSON results: +
      +
    • $ capa -j /path/to/file > result.json
      • +
    +
    6. +
  6. Load the JSON results file into capa Explorer Web

For more detailed information, explore the - capa GitHub repository. + capa GitHub repository + + . +

+
+
+

+ You can download capa Explorer Web for offline usage via the download button in the top-right corner of + this page.

@@ -39,7 +68,6 @@ /* highlight inline code */ code { background-color: #e2e8f0; - padding: 2px 4px; border-radius: 4px; font-family: monospace; } diff --git a/web/explorer/src/components/MetadataPanel.vue b/web/explorer/src/components/MetadataPanel.vue index 504676c6d..4bc9851fa 100644 --- a/web/explorer/src/components/MetadataPanel.vue +++ b/web/explorer/src/components/MetadataPanel.vue @@ -11,7 +11,7 @@

SHA256: - {{ sha256 }} + {{ sha256 }}

@@ -23,20 +23,20 @@
{{ data.meta.analysis.os }} - • + • {{ data.meta.analysis.format }} - • + • {{ data.meta.analysis.arch === "i386" ? "i386" : data.meta.analysis.arch.toUpperCase() }}
- {{ flavor }} analysis with {{ data.meta.analysis.extractor.split(/(Feature)?Extractor/)[0] }} + {{ flavor }} analysis with {{ data.meta.analysis.extractor.split(/(Feature)?Extractor/)[0] }} + - • + • capa v{{ data.meta.version }} - • + • {{ new Date(data.meta.timestamp).toLocaleString() }}
diff --git a/web/explorer/src/components/NavBar.vue b/web/explorer/src/components/NavBar.vue index 28a37d611..061829362 100644 --- a/web/explorer/src/components/NavBar.vue +++ b/web/explorer/src/components/NavBar.vue @@ -17,10 +17,10 @@ const isBundle = import.meta.env.MODE === "bundle"; diff --git a/web/explorer/src/components/ProcessCapabilities.vue b/web/explorer/src/components/ProcessCapabilities.vue index cd0fa798a..63f78f6ee 100644 --- a/web/explorer/src/components/ProcessCapabilities.vue +++ b/web/explorer/src/components/ProcessCapabilities.vue @@ -22,7 +22,7 @@ > {{ slotProps.node.data.processname }} - - PID: {{ slotProps.node.data.pid }} + - PID: {{ slotProps.node.data.pid }} ({{ slotProps.node.data.uniqueMatchCount }} unique {{ slotProps.node.data.uniqueMatchCount > 1 ? "matches" : "match" }}) @@ -53,9 +53,9 @@ >
• {{ rule.name }} - ({{ rule.matchCount }} {{ rule.scope }} {{ rule.matchCount > 1 ? "matches" : "match" }}) + + ({{ rule.matchCount }} {{ rule.scope }} {{ rule.matchCount > 1 ? "matches" : "match" }}) +
diff --git a/web/explorer/src/components/RuleMatchesTable.vue b/web/explorer/src/components/RuleMatchesTable.vue index 91718c0a5..fe891901f 100644 --- a/web/explorer/src/components/RuleMatchesTable.vue +++ b/web/explorer/src/components/RuleMatchesTable.vue @@ -67,7 +67,7 @@ /> diff --git a/web/explorer/src/components/SettingsPanel.vue b/web/explorer/src/components/SettingsPanel.vue index 9dddd2f0f..f559e5d21 100644 --- a/web/explorer/src/components/SettingsPanel.vue +++ b/web/explorer/src/components/SettingsPanel.vue @@ -28,7 +28,7 @@
- +
- +
diff --git a/web/explorer/src/components/columns/RuleColumn.vue b/web/explorer/src/components/columns/RuleColumn.vue index 1baab06bd..2a23a2749 100644 --- a/web/explorer/src/components/columns/RuleColumn.vue +++ b/web/explorer/src/components/columns/RuleColumn.vue @@ -17,8 +17,8 @@ -