Skip to content

Releases: mandiant/capa

v6.0.0

18 Jul 16:29
@williballenthin williballenthin
v6.0.0
781c33d
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v6.0.0

v6.0.0

capa v6.0 brings many bug fixes and quality improvements, including 64 rule updates and 26 new rules. We're now publishing to PyPI via Trusted Publishing and have migrated to using a pyproject.toml file. @Aayush-Goel-04 contributed a lot of new code across many files, so please welcome them to the project, along with @anders-v @crowface28 @dkelly2e @RonnieSalomonsen and @ejfocampo as first-time rule contributors!

For those that use capa as a library, we've introduced some limited breaking changes that better represent data types (versus less-structured data like dictionaries and strings). With the recent deprecation, we've also dropped support for Python 3.7.

New Features

Breaking Changes

New Rules (26)

Bug Fixes

  • extractor: add a Binary Ninja test that asserts its version #1487 @xusheng6
  • extractor: update Binary Ninja stack string detection after the new constant outlining feature #1473 @xusheng6
  • extractor: update vivisect Arch extraction #1334 @mr-tz
  • extractor: avoid Binary Ninja exception when analyzing certain files #1441 @xusheng6
  • symtab: fix struct.unpack() format for 64-bit ELF files @yelhamer
  • symtab: safeguard against ZeroDivisionError for files containing a symtab with a null entry size @yelhamer
  • improve ELF strtab and needed parsing @mr-tz
  • better handle exceptional cases when parsing ELF files #1458 @Aayush-Goel-04
  • improved testing coverage for Binary Ninja backend #1446 @Aayush-Goel-04
  • add logging and print redirect to tqdm for capa main #749 @Aayush-Goel-04
  • extractor: fix binja installation path detection does not work with Python 3.11
  • tests: refine the IDA test runner script #1513 @williballenthin
  • output: don't leave behind traces of progress bar @williballenthin
  • import-to-ida: fix bug introduced with JSON report changes in v5 #1584 @williballenthin
  • main: don't show spinner when emitting debug messages #1636 @williballenthin

capa explorer IDA Pro plugin

Development

Raw diffs

Contributors

williballenthin, dkelly2e, and 9 other contributors
Assets 5
Loading

v5.1.0

06 Apr 11:11
@mr-tz mr-tz
v5.1.0
7c4a46b
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v5.1.0

capa version 5.1.0 adds a Protocol Buffers (protobuf) format for result documents. Additionally, the Vector35 team contributed a new feature extractor using Binary Ninja. Other new features are a new CLI flag to override the detected operating system, functionality to read and render existing result documents, and a output color format that's easier to read.

Over 25 capa rules have been added and improved.

Thanks for all the support, especially to @xusheng6, @captainGeech42, @ggold7046, @manasghandat, @ooprathamm, @linpeiyu164, @yelhamer, @HongThatCong, @naikordian, @stevemk14ebr, @emtuls, @raymondlleong, @bkojusner, @joren485, and everyone else who submitted bugs and provided feedback!

New Features

New Rules (26)

Bug Fixes

  • extractor: removed '.dynsym' as the library name for ELF imports #1318 @stevemk14ebr
  • extractor: fix vivisect loop detection corner case #1310 @mr-tz
  • match: extend OS characteristic to match OS_ANY to all supported OSes #1324 @mike-hunhoff
  • extractor: fix IDA and vivisect string and bytes features overlap and tests #1327 #1336 @xusheng6

capa explorer IDA Pro plugin

Raw diffs

Contributors

williballenthin, captainGeech42, and 15 other contributors
Assets 5
Loading

v5.0.0

08 Feb 20:37
@mr-tz mr-tz
v5.0.0
c2346f4
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v5.0.0

This capa version comes with major improvements and additions to better handle .NET binaries. To showcase this we've updated and added over 30 .NET rules.

Additionally, capa now caches its rule set for better performance. The capa explorer also caches its analysis results, so that multiple IDA Pro or plugin invocations don't need to repeat the same analysis.

We have removed the SMDA backend and changed the program return codes to be positive numbers.

Other improvements to highlight include better ELF OS detection, various rendering bug fixes, and enhancements to the feature extraction. We've also added support for Python 3.11.

Thanks for all the support, especially to @jsoref, @bkojusner, @edeca, @richardweiss80, @joren485, @ryantxu1, @mwilliams31, @anushkavirgaonkar, @MalwareMechanic, @Still34, @dzbeck, @johnk3r, and everyone else who submitted bugs and provided feedback!

New Features

Breaking Changes

New Rules (77)

Bug Fixes

capa explorer IDA Pro plugin

Raw diffs

Contributors

williballenthin, edeca, and 15 other contributors
Assets 5
Loading

v4.0.1

15 Aug 11:28
@mr-tz mr-tz
v4.0.1
3c41415
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v4.0.1

Some rules contained invalid metadata fields that caused an error when rendering rule hits. We've updated all rules and enhanced the rule linter to catch such issues.

New Rules (1)

Bug Fixes

  • linter: use pydantic to validate rule metadata #1141 @mike-hunhoff
  • build binaries using PyInstaller no longer overwrites functions in version.py #1136 @mr-tz

Raw diffs

Contributors

mr-tz and mike-hunhoff
Assets 5
Loading

v4.0.0

10 Aug 13:36
@mr-tz mr-tz
v4.0.0
81cb4b3
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v4.0.0

Version 4 adds support for analyzing .NET executables. capa will autodetect .NET modules, or you can explicitly invoke the new feature extractor via --format dotnet. We've also extended the rule syntax for .NET features including namespace and class.

Additionally, new instruction scope and operand features enable users to create more explicit rules. These features are not backwards compatible. We removed the previously used /x32 and /x64 flavors of number and operand features.

We updated 49 existing rules and added 22 new rules leveraging these new features and characteristics to detect capabilities seen in .NET malware.

More breaking changes include updates to the JSON results document, freeze file format schema (now format version v2), and the internal handling of addresses.

Thanks for all the support, especially to @htnhan, @jtothej, @sara-rn, @anushkavirgaonkar, and @_re_fox!

Deprecation warning: v4.0 will be the last capa version to support the SMDA backend.

New Features

Breaking Changes

  • instruction scope and operand feature are new and are not backwards compatible with older versions of capa
  • Python 3.7 is now the minimum supported Python version #866 @williballenthin
  • remove /x32 and /x64 flavors of number and operand features #932 @williballenthin
  • the tool now accepts multiple paths to rules, and JSON doc updated accordingly @williballenthin
  • extractors must use handles to identify functions/basic blocks/instructions #981 @williballenthin
  • the freeze file format schema was updated, including format version bump to v2 #986 @williballenthin

Deprecation notice: as described in #937, we plan to remove the SMDA backend for v5. If you rely on this backend, please reach out so we can discuss extending the support for SMDA or transitioning your workflow to use vivisect.

New Rules (30)

Bug Fixes

capa explorer IDA Pro plugin

Raw diffs

Contributors

williballenthin, htnhan, and 5 other contributors
Assets 5
Loading

v3.2.1

06 Jul 20:49
@williballenthin williballenthin
v3.2.1
ed870ea
Compare
Choose a tag to compare
v3.2.1

This release bumps the SMDA dependency version to enable installation on Python 3.10.

Bug Fixes

Raw diffs

Contributors

mike-hunhoff
Assets 3
Loading

v3.2.0

03 Mar 19:03
@mr-tz mr-tz
v3.2.0
d9d72ad
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v3.2.0

This release adds a new characteristic call $+5 enabling users to create rules that match this instruction commonly seen in obfuscators. The linter now also validates ATT&CK and MBC categories. Additionally, many dependencies, including the vivisect backend, have been updated.

One rule has been added and many more have been improved.

Thanks for all the support, especially to @kn0wl3dge and first time contributor @uckelman-sf!

New Features

New Rules (1)

Bug Fixes

Raw diffs

Contributors

williballenthin, kn0wl3dge, and uckelman-sf
Assets 5
Loading

v3.1.0

12 Jan 21:19
@williballenthin williballenthin
v3.1.0
c0851fc
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v3.1.0

This release improves the performance of capa while also adding 23 new rules and many code quality enhancements. We profiled capa's CPU usage and optimized the way that it matches rules, such as by short circuiting when appropriate. According to our testing, the matching phase is approximately 66% faster than v3.0.3! We also added support for Python 3.10, aarch64 builds, and additional MAEC metadata in the rule headers.

This release adds 23 new rules, including nine by Jakub Jozwiak of Mandiant. @ryantxu1 and @dzbeck updated the ATT&CK and MBC mappings for many rules. Thank you!

And as always, welcome first time contributors!

New Features

Breaking Changes: None

New Rules (23)

Rule Changes

Bug Fixes

capa explorer IDA Pro plugin

Development

Raw diffs

Contributors

williballenthin, cl30, and 9 other contributors
Assets 5
Loading

v3.0.3

27 Oct 16:15
@williballenthin williballenthin
v3.0.3
29e61e2
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v3.0.3

v3.0.3 (2021-10-27)

This is primarily a rule maintenance release:

  • eight new rules, including all relevant techniques from ATT&CK v10, and
  • two rules removed, due to the prevalence of false positives

We've also tweaked the status codes returned by capa.exe to be more specific and added a bit more metadata to the JSON output format.

As always, welcome first time contributors!

New Features

New Rules (8)

Removed rules (2)

  • load-code/pe/parse-pe-exports: too many false positives in unrelated structure accesses
  • anti-analysis/anti-vm/vm-detection/execute-anti-vm-instructions: too many false positives in junk code

Bug Fixes

  • update references from FireEye to Mandiant

Raw diffs

Contributors

williballenthin
Assets 5
Loading

v3.0.2

28 Sep 16:25
@williballenthin williballenthin
v3.0.2
ead8a83
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v3.0.2

This release fixes an issue with the standalone executables built with PyInstaller when running capa against ELF files.

Bug Fixes

  • fix bug in PyInstaller config preventing ELF analysis #795 @mr-tz

Raw diffs

Contributors

mr-tz
Assets 5
Loading