Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feature: instruction scope #930

Merged
merged 39 commits into from
Apr 4, 2022
Merged

feature: instruction scope #930

Changes from 1 commit
Commits
Show all changes
39 commits
Select commit Hold shift + click to select a range
a203f56
rules: add new scope "instruction"
williballenthin Mar 28, 2022
c8fedb0
gitignore
williballenthin Mar 28, 2022
9da9c3a
rules: add valid features for insn scope
williballenthin Mar 28, 2022
890870b
rules: let subscope blocks have descriptions
williballenthin Mar 28, 2022
2baf05a
rules: parse instruction subscope with implied AND
williballenthin Mar 28, 2022
b0619f4
rules: index instruction rules in ruleset
williballenthin Mar 28, 2022
46cc681
tests: demonstrate instruct subscope rule extraction
williballenthin Mar 28, 2022
dde52f2
pep8
williballenthin Mar 28, 2022
031ea16
add pycodestyle config
williballenthin Mar 28, 2022
963cfbf
pep8
williballenthin Mar 28, 2022
00d439f
main: rename find_code_capabilities
williballenthin Mar 28, 2022
b76930d
main: split out basic block feature, match extraction
williballenthin Mar 28, 2022
bd6e62e
Update scripts/lint.py
williballenthin Mar 29, 2022
7487da8
Merge branch 'master' into feature-insn-scope
williballenthin Mar 29, 2022
565e4e0
Merge branch 'feature-insn-scope' of github.com:mandiant/capa into fe…
williballenthin Mar 29, 2022
c1b28f5
rules: don't use global features to downselect rules
williballenthin Mar 29, 2022
1a28c32
rules: doc
williballenthin Mar 29, 2022
1839746
main: factor out matching at instruction scope
williballenthin Mar 29, 2022
0effb5f
changelog
williballenthin Mar 29, 2022
e0fca27
rules: update valid features per scope
williballenthin Mar 29, 2022
fb6b60b
tests: add tests demonstrating instruction (sub)scope matching
williballenthin Mar 29, 2022
49adb8d
pep8
williballenthin Mar 29, 2022
d8d671e
rules: add global scope features to file scope
williballenthin Mar 30, 2022
b942050
features: viv: factor out operand feature extraction
williballenthin Mar 30, 2022
cce1e41
formatting
williballenthin Mar 30, 2022
e4c5ec2
features: insn: define OperandImmediate and OperandOffset
williballenthin Mar 30, 2022
6cbbd4d
rules: parse OperandOffset and OperandImmediate features
williballenthin Mar 30, 2022
c7aadca
tests: demonstrate OperandOffset and OperandImmediate
williballenthin Mar 30, 2022
997daf5
viv: insn: extract OperandOffset and OperandImmediate
williballenthin Mar 30, 2022
76831e9
changelog
williballenthin Mar 30, 2022
9da4ff1
*: rename OperandImmediate to OperandNumber
williballenthin Mar 31, 2022
8564433
viv: insn: fix OperandNumber reference
williballenthin Mar 31, 2022
85b1d50
isort
williballenthin Mar 31, 2022
2989af0
features: use ABC to denote abstract classes
williballenthin Apr 4, 2022
b318b0a
freeze: fix freeze_deserialize for features with multiple args
williballenthin Apr 4, 2022
750803c
freeze: register operand features
williballenthin Apr 4, 2022
0af60d9
freeze: fix mypy
williballenthin Apr 4, 2022
ef93fcc
tests: smda: xfail operand number/offset features
williballenthin Apr 4, 2022
5ffb73c
ida: insn: extract operand number and offset features
Apr 4, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions capa/rules.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,11 +74,13 @@ class Scope(str, Enum):
FILE = "file"
FUNCTION = "function"
BASIC_BLOCK = "basic block"
INSTRUCTION = "instruction"


FILE_SCOPE = Scope.FILE.value
FUNCTION_SCOPE = Scope.FUNCTION.value
BASIC_BLOCK_SCOPE = Scope.BASIC_BLOCK.value
INSTRUCTION_SCOPE = Scope.INSTRUCTION.value


SUPPORTED_FEATURES = {
Expand Down