From fd811d13875f7daccd6b651910d6ba181f20540e Mon Sep 17 00:00:00 2001 From: Yacine Elhamer Date: Mon, 1 Jul 2024 09:55:24 +0100 Subject: [PATCH 1/5] scripts/show-features.py: use extractor.get_process_name() interface for getting process name --- scripts/show-features.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/show-features.py b/scripts/show-features.py index 9813a26dd..30ad2a4be 100644 --- a/scripts/show-features.py +++ b/scripts/show-features.py @@ -227,13 +227,13 @@ def print_static_features(functions, extractor: StaticFeatureExtractor): def print_dynamic_features(processes, extractor: DynamicFeatureExtractor): for p in processes: - print(f"proc: {p.inner.process_name} (ppid={p.address.ppid}, pid={p.address.pid})") + print(f"proc: {extractor.get_process_name(p)} (ppid={p.address.ppid}, pid={p.address.pid})") for feature, addr in extractor.extract_process_features(p): if is_global_feature(feature): continue - print(f" proc: {p.inner.process_name}: {feature}") + print(f" proc: {extractor.get_process_name(p)}: {feature}") for t in extractor.get_threads(p): print(f" thread: {t.address.tid}") From 6de22a0264f1bbf4066240ecebdca25ced06cc53 Mon Sep 17 00:00:00 2001 From: Yacine Elhamer Date: Mon, 1 Jul 2024 10:34:19 +0100 Subject: [PATCH 2/5] show-features.py: fix process filtering bug --- scripts/show-features.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/scripts/show-features.py b/scripts/show-features.py index 30ad2a4be..e1bd87ba1 100644 --- a/scripts/show-features.py +++ b/scripts/show-features.py @@ -171,8 +171,8 @@ def print_dynamic_analysis(extractor: DynamicFeatureExtractor, args): process_handles = tuple(extractor.get_processes()) if args.process: - process_handles = tuple(filter(lambda ph: ph.inner["name"] == args.process, process_handles)) - if args.process not in [ph.inner["name"] for ph in args.process]: + process_handles = tuple(filter(lambda ph: extractor.get_process_name(ph) == args.process, process_handles)) + if args.process not in [extractor.get_process_name(ph) for ph in process_handles]: print(f"{args.process} not a process") return -1 @@ -227,13 +227,13 @@ def print_static_features(functions, extractor: StaticFeatureExtractor): def print_dynamic_features(processes, extractor: DynamicFeatureExtractor): for p in processes: - print(f"proc: {extractor.get_process_name(p)} (ppid={p.address.ppid}, pid={p.address.pid})") + print(f"proc: {p.inner.process_name} (ppid={p.address.ppid}, pid={p.address.pid})") for feature, addr in extractor.extract_process_features(p): if is_global_feature(feature): continue - print(f" proc: {extractor.get_process_name(p)}: {feature}") + print(f" proc: {p.inner.process_name}: {feature}") for t in extractor.get_threads(p): print(f" thread: {t.address.tid}") From 0b70abca9374265e655d6bc1db7b0d73e157f3c1 Mon Sep 17 00:00:00 2001 From: Yacine Elhamer Date: Mon, 1 Jul 2024 12:03:12 +0100 Subject: [PATCH 3/5] show-features.py: add other usage of get_process_name() --- scripts/show-features.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/show-features.py b/scripts/show-features.py index e1bd87ba1..188aa974b 100644 --- a/scripts/show-features.py +++ b/scripts/show-features.py @@ -227,13 +227,13 @@ def print_static_features(functions, extractor: StaticFeatureExtractor): def print_dynamic_features(processes, extractor: DynamicFeatureExtractor): for p in processes: - print(f"proc: {p.inner.process_name} (ppid={p.address.ppid}, pid={p.address.pid})") + print(f"proc: {extractor.get_process_name(p)} (ppid={p.address.ppid}, pid={p.address.pid})") for feature, addr in extractor.extract_process_features(p): if is_global_feature(feature): continue - print(f" proc: {p.inner.process_name}: {feature}") + print(f" proc: {extractor.get_process_name(p)}: {feature}") for t in extractor.get_threads(p): print(f" thread: {t.address.tid}") From 3b165c3d8e4cfffe3b22aadc803f200f488d15d8 Mon Sep 17 00:00:00 2001 From: Yacine Elhamer Date: Mon, 1 Jul 2024 21:41:46 +0100 Subject: [PATCH 4/5] test:scripts.py: add tests for show-features.py process filtering --- tests/test_scripts.py | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-) diff --git a/tests/test_scripts.py b/tests/test_scripts.py index 9bad30132..b3c458440 100644 --- a/tests/test_scripts.py +++ b/tests/test_scripts.py @@ -23,10 +23,21 @@ def get_script_path(s: str): return str(CD / ".." / "scripts" / s) -def get_file_path(): +def get_binary_file_path(): return str(CD / "data" / "9324d1a8ae37a36ae560c37448c9705a.exe_") +def get_report_file_path(): + return str( + CD + / "data" + / "dynamic" + / "cape" + / "v2.4" + / "fb7ade52dc5a1d6128b9c217114a46d0089147610f99f5122face29e429a1e74.json.gz" + ) + + def get_rules_path(): return str(CD / ".." / "rules") @@ -48,12 +59,13 @@ def get_rule_path(): pytest.param("lint.py", ["-t", "create directory", get_rules_path()]), # `create directory` rule has native and .NET example PEs pytest.param("lint.py", ["--thorough", "-t", "create directory", get_rules_path()]), - pytest.param("match-function-id.py", [get_file_path()]), - pytest.param("show-capabilities-by-function.py", [get_file_path()]), - pytest.param("show-features.py", [get_file_path()]), - pytest.param("show-features.py", ["-F", "0x407970", get_file_path()]), - pytest.param("show-unused-features.py", [get_file_path()]), - pytest.param("capa_as_library.py", [get_file_path()]), + pytest.param("match-function-id.py", [get_binary_file_path()]), + pytest.param("show-capabilities-by-function.py", [get_binary_file_path()]), + pytest.param("show-features.py", [get_binary_file_path()]), + pytest.param("show-features.py", ["-F", "0x407970", get_binary_file_path()]), + pytest.param("show-features.py", ["-P", "MicrosoftEdgeUpdate.exe", get_report_file_path]), + pytest.param("show-unused-features.py", [get_binary_file_path()]), + pytest.param("capa_as_library.py", [get_binary_file_path()]), ], ) def test_scripts(script, args): From fccb5338411a33ae9415b5243d1c25ccac4082e6 Mon Sep 17 00:00:00 2001 From: Yacine Elhamer Date: Mon, 1 Jul 2024 21:59:28 +0100 Subject: [PATCH 5/5] test/scripts.py: bugfix --- tests/test_scripts.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/test_scripts.py b/tests/test_scripts.py index b3c458440..35bf5347f 100644 --- a/tests/test_scripts.py +++ b/tests/test_scripts.py @@ -63,7 +63,7 @@ def get_rule_path(): pytest.param("show-capabilities-by-function.py", [get_binary_file_path()]), pytest.param("show-features.py", [get_binary_file_path()]), pytest.param("show-features.py", ["-F", "0x407970", get_binary_file_path()]), - pytest.param("show-features.py", ["-P", "MicrosoftEdgeUpdate.exe", get_report_file_path]), + pytest.param("show-features.py", ["-P", "MicrosoftEdgeUpdate.exe", get_report_file_path()]), pytest.param("show-unused-features.py", [get_binary_file_path()]), pytest.param("capa_as_library.py", [get_binary_file_path()]), ],