Merge pull request #2300 from s-ff/add-file-scope-rules

mandiant · Aug 17, 2024 · c409b2b · c409b2b
2 parents 6b4591d + 4501955
commit c409b2b
Show file tree

Hide file tree

Showing 3 changed files with 40 additions and 7 deletions.
diff --git a/web/explorer/src/components/FunctionCapabilities.vue b/web/explorer/src/components/FunctionCapabilities.vue
@@ -26,7 +26,7 @@
             :showClearButton="false"
         >
             <template #filter v-if="props.showColumnFilters">
-                <InputText v-model="filters['address'].value" placeholder="Filter by name" />
+                <InputText v-model="filters['address'].value" placeholder="Filter by function address" />
             </template>
             <template #body="{ data }">
                 <span class="font-monospace text-base">{{ data.address }}</span>
@@ -36,19 +36,19 @@
             </template>
         </Column>
 
-        <Column field="rule" sortable header="Matches" class="w-min" :showFilterMenu="false" :showClearButton="false">
+        <Column field="rule" header="Rule Matches" class="w-min" :showFilterMenu="false" :showClearButton="false">
             <template #filter v-if="props.showColumnFilters">
-                <InputText v-model="filters['rule'].value" placeholder="Filter by name" />
+                <InputText v-model="filters['rule'].value" placeholder="Filter by rule" />
             </template>
             <template #body="{ data }">
                 {{ data.rule }}
                 <LibraryTag v-if="data.lib" />
             </template>
         </Column>
 
-        <Column field="namespace" sortable header="Namespace" :showFilterMenu="false" :showClearButton="false">
+        <Column field="namespace" header="Namespace" :showFilterMenu="false" :showClearButton="false">
             <template #filter v-if="props.showColumnFilters">
-                <InputText v-model="filters['namespace'].value" placeholder="Filter by name" />
+                <InputText v-model="filters['namespace'].value" placeholder="Filter by namespace" />
             </template>
         </Column>
     </DataTable>

diff --git a/web/explorer/src/components/columns/RuleColumn.vue b/web/explorer/src/components/columns/RuleColumn.vue
@@ -31,7 +31,15 @@
         <template v-else-if="node.data.type === 'feature'">
             <span>
                 - {{ node.data.typeValue }}:
-                <span :class="{ 'text-green-700': node.data.typeValue !== 'regex' }" class="font-monospace">
+                <span
+                    :class="{ 'text-green-700': node.data.typeValue !== 'regex' }"
+                    class="font-monospace"
+                    v-tooltip.top="{
+                        value: getTooltipContent(node.data),
+                        showDelay: 1000,
+                        hideDelay: 300
+                    }"
+                >
                     {{ node.data.name }}
                 </span>
             </span>
@@ -63,4 +71,12 @@ defineProps({
         required: true
     }
 });
+
+const getTooltipContent = (data) => {
+    if (data.typeValue === "number" || data.typeValue === "offset") {
+        const decimalValue = parseInt(data.name, 16);
+        return `Decimal: ${decimalValue}`;
+    }
+    return null;
+};
 </script>
diff --git a/web/explorer/src/utils/rdocParser.js b/web/explorer/src/utils/rdocParser.js
@@ -108,6 +108,9 @@ export function parseFunctionCapabilities(doc) {
     // Map to store capabilities matched to each function
     const matchesByFunction = new Map();
 
+    // Add a special entry for file-level matches
+    matchesByFunction.set("file", new Set());
+
     // Iterate through all rules in the document
     for (const [, rule] of Object.entries(doc.rules)) {
         if (rule.meta.scopes.static === "function") {
@@ -133,12 +136,26 @@ export function parseFunctionCapabilities(doc) {
                         .add({ name: rule.meta.name, namespace: rule.meta.namespace, lib: rule.meta.lib });
                 }
             }
+        } else if (rule.meta.scopes.static === "file") {
+            // Add file-level matches to the special 'file' entry
+            matchesByFunction.get("file").add({
+                name: rule.meta.name,
+                namespace: rule.meta.namespace,
+                lib: rule.meta.lib
+            });
         }
-        // (else) Ignoring file scope rules
     }
 
     const result = [];
 
+    // Add file-level matches if there are any
+    if (matchesByFunction.get("file").size > 0) {
+        result.push({
+            address: "file",
+            capabilities: Array.from(matchesByFunction.get("file"))
+        });
+    }
+
     // Iterate through all functions in the document
     for (const f of doc.meta.analysis.feature_counts.functions) {
         const addr = formatAddress(f.address);