From 5721a2f80d93feee5d91eee83d92aab0182a0fb1 Mon Sep 17 00:00:00 2001 From: Maxou56800 Date: Thu, 11 Jul 2024 17:11:48 +0200 Subject: [PATCH 1/4] Fix binja warning (use of a deprecated API method) --- capa/features/extractors/binja/extractor.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/capa/features/extractors/binja/extractor.py b/capa/features/extractors/binja/extractor.py index e8d42908d..e542494af 100644 --- a/capa/features/extractors/binja/extractor.py +++ b/capa/features/extractors/binja/extractor.py @@ -28,7 +28,7 @@ class BinjaFeatureExtractor(StaticFeatureExtractor): def __init__(self, bv: binja.BinaryView): - super().__init__(hashes=SampleHashes.from_bytes(bv.file.raw.read(0, len(bv.file.raw)))) + super().__init__(hashes=SampleHashes.from_bytes(bv.file.raw.read(0, bv.file.raw.length))) self.bv = bv self.global_features: List[Tuple[Feature, Address]] = [] self.global_features.extend(capa.features.extractors.binja.file.extract_file_format(self.bv)) From 04cea3dd591f5b71b1a5a5da8d27c0a0fcb38de6 Mon Sep 17 00:00:00 2001 From: Maxou56800 Date: Thu, 11 Jul 2024 17:25:30 +0200 Subject: [PATCH 2/4] Update binja plugin > Fix json openning and parsing > Fix base address --- scripts/import-to-bn.py | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) diff --git a/scripts/import-to-bn.py b/scripts/import-to-bn.py index 7fefcd2fb..97c0bde2a 100644 --- a/scripts/import-to-bn.py +++ b/scripts/import-to-bn.py @@ -69,7 +69,8 @@ def load_analysis(bv): return 0 binaryninja.log_info(f"Using capa file {path}") - doc = json.loads(path.read_bytes().decode("utf-8")) + with Path(path).open("r", encoding="utf-8") as file: + doc = json.load(file) if "meta" not in doc or "rules" not in doc: binaryninja.log_error("doesn't appear to be a capa report") @@ -83,20 +84,35 @@ def load_analysis(bv): binaryninja.log_error("sample mismatch") return -2 + # Retreive base address + capa_base_address = 0 + if "analysis" in doc["meta"] and "base_address" in doc["meta"]["analysis"]: + if doc["meta"]["analysis"]["base_address"]["type"] == "absolute": + capa_base_address = int(doc["meta"]["analysis"]["base_address"]["value"]) + rows = [] for rule in doc["rules"].values(): if rule["meta"].get("lib"): continue if rule["meta"].get("capa/subscope"): continue - if rule["meta"]["scope"] != "function": + if rule["meta"]["scopes"].get("static") != "function": continue name = rule["meta"]["name"] ns = rule["meta"].get("namespace", "") - for va in rule["matches"].keys(): - va = int(va) - rows.append((ns, name, va)) + for matches in rule["matches"]: + for match in matches: + if not "type" in match.keys(): + continue + if not "value" in match.keys(): + continue + va = match["value"] + # Substract va and CAPA base_address + va = int(va)-capa_base_address + # Add binja base address + va = va + bv.start + rows.append((ns, name, va)) # order by (namespace, name) so that like things show up together rows = sorted(rows) From 5c3e8174861b03c6296040d1c1e0674a4b719916 Mon Sep 17 00:00:00 2001 From: Maxou56800 Date: Thu, 11 Jul 2024 18:14:39 +0200 Subject: [PATCH 3/4] Fix code_style --- scripts/import-to-bn.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/import-to-bn.py b/scripts/import-to-bn.py index 97c0bde2a..a9cc9980c 100644 --- a/scripts/import-to-bn.py +++ b/scripts/import-to-bn.py @@ -103,9 +103,9 @@ def load_analysis(bv): ns = rule["meta"].get("namespace", "") for matches in rule["matches"]: for match in matches: - if not "type" in match.keys(): + if "type" not in match.keys(): continue - if not "value" in match.keys(): + if "value" not in match.keys(): continue va = match["value"] # Substract va and CAPA base_address From d29dd45b3cbcb0fdb3dd7db86d99398c8cd9ad68 Mon Sep 17 00:00:00 2001 From: Maxou56800 Date: Fri, 12 Jul 2024 10:51:38 +0200 Subject: [PATCH 4/4] lint black update --- scripts/import-to-bn.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/scripts/import-to-bn.py b/scripts/import-to-bn.py index a9cc9980c..b09780a65 100644 --- a/scripts/import-to-bn.py +++ b/scripts/import-to-bn.py @@ -108,9 +108,9 @@ def load_analysis(bv): if "value" not in match.keys(): continue va = match["value"] - # Substract va and CAPA base_address - va = int(va)-capa_base_address - # Add binja base address + # Substract va and CAPA base_address + va = int(va) - capa_base_address + # Add binja base address va = va + bv.start rows.append((ns, name, va))