From e9ccc5276ab3a4a76486566b63cec84fdf1c3ec0 Mon Sep 17 00:00:00 2001 From: Willi Ballenthin Date: Thu, 13 Jul 2023 06:24:22 +0200 Subject: [PATCH 1/2] main: log time taken to analyze each function closes #1290 --- capa/main.py | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/capa/main.py b/capa/main.py index 9e6606c9f..c680f138d 100644 --- a/capa/main.py +++ b/capa/main.py @@ -266,6 +266,7 @@ def pbar(s, *args, **kwargs): pb = pbar(functions, desc="matching", unit=" functions", postfix="skipped 0 library functions", leave=False) for f in pb: + t0 = time.time() if extractor.is_library_function(f.address): function_name = extractor.get_function_name(f.address) logger.debug("skipping library function 0x%x (%s)", f.address, function_name) @@ -284,7 +285,18 @@ def pbar(s, *args, **kwargs): feature_counts.functions += ( rdoc.FunctionFeatureCount(address=frz.Address.from_capa(f.address), count=feature_count), ) - logger.debug("analyzed function 0x%x and extracted %d features", f.address, feature_count) + t1 = time.time() + + match_count = sum(len(res) for res in function_matches.values()) + match_count += sum(len(res) for res in bb_matches.values()) + match_count += sum(len(res) for res in insn_matches.values()) + logger.debug( + "analyzed function 0x%x and extracted %d features, %d matches in %0.02fs", + f.address, + feature_count, + match_count, + t1 - t0, + ) for rule_name, res in function_matches.items(): all_function_matches[rule_name].extend(res) From 0511ef70932e257d259d10bd6c82630a6b2dee78 Mon Sep 17 00:00:00 2001 From: Willi Ballenthin Date: Thu, 13 Jul 2023 06:26:25 +0200 Subject: [PATCH 2/2] changelog --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index e2debfaa5..6e30fbe96 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -64,6 +64,7 @@ ### Development - update ATT&CK/MBC data for linting #1568 @mr-tz +- log time taken to analyze each function #1290 @williballenthin ### Raw diffs - [capa v5.1.0...master](https://github.com/mandiant/capa/compare/v5.1.0...master)