Releases: mandiant/capa
v7.4.0
The v7.4.0 capa release fixes a bug when processing VMRay analysis archives and enhances API extraction for all dynamic backends. For better terminal rendering capa now solely relies on the rich library.
The standalone capa executable can now automatically detect installations of relevant third party applications and use their backends (notably, idalib and Binary Ninja). For the extra standalone Linux build we've upgraded from Python 3.11 to 3.12.
Twelve new rules have been added. Thanks to all the contributors!
This is the last capa version supporting Python 3.8 and 3.9. If you have major concerns about this please reach out to us.
New Features
- add IDA v9.0 backend via idalib #2376 @williballenthin
- locate Binary Ninja API using XDG Desktop Entries #2376 @williballenthin
New Rules (15)
- nursery/access-unmanaged-com-objects-in-dotnet [email protected]
- nursery/implement-ui-automation-client-in-dotnet [email protected]
- nursery/interact-with-shortcut-via-iwshshortcut-in-dotnet [email protected]
- nursery/interact-with-windows-scripting-host-in-dotnet [email protected]
- nursery/use-dotnet-library-simplejson [email protected]
- nursery/use-dotnet-library-websocket-sharp [email protected]
- linking/runtime-linking/populate-syswhispers2-syscall-list [email protected]
- host-interaction/os/hide-shutdown-actions-via-policy [email protected]
- host-interaction/process/get-process-filename [email protected]
- host-interaction/driver/complete-processing-asynchronous-io-request [email protected]
- anti-analysis/packer/nmm-protect/packed-with-nmm-protect [email protected]
- host-interaction/firewall/modify/access-firewall-policy-via-inetfwpolicy2 [email protected]
- host-interaction/firewall/modify/access-firewall-rule-properties-via-inetfwrule [email protected]
- host-interaction/registry/open-recentdocs-registry-key [email protected]
Bug Fixes
- use Python 3.12 to build extra standalone build on Linux #2383 @williballenthin
- bump minimum Python version to 3.8.1 to satisfy uv #2387 @williballenthin
- vmray: collect more process information from flog.xml #2394 @mr-tz @mike-hunhoff
- replace tabulate, tqdm, and termcolor with rich #2374 @s-ff
- dynamic: emit complete features for A/W APIs #2409 @mike-hunhoff
- vmray: fix backslash handling in string call arguments #2428 @mr-tz
capa Explorer Web
Raw diffs
Contributors
Assets 6
v7.3.0
The v7.3.0 capa release comes with the following three major enhancements:
1. Support for VMRay sandbox analysis archives
Unlock powerful malware analysis with capa's new VMRay sandbox integration! Simply provide a VMRay analysis archive, and capa will automatically extract and match capabilities to streamline your workflow. This is the second support for the analysis of dynamic analysis results after CAPE.
2. Support for BinExport files generated by Ghidra
BinExport files store disassembled data into a Protocol Buffer format. capa now supports the analysis of BinExport files generated by Ghidra. Using Ghidra and the BinExport file format users can now analyze ARM (AARCH64) ELF files targeting Android.
3. Introducing the capa rules website
You can now browse capa's default rule set at https://mandiant.github.io/capa/rules. In modern terminals the CLI capa tool hyperlinks to resources on the web, including entries on the capa rules website.
Furthermore, https://mandiant.github.io/capa provides a landing page for the capa tool project.
Additional updates
- capa Explorer Web received several enhancements and bug fixes.
- Support for the IDA Pro 9.0 IDAPython API while keeping compatibility to older IDA Pro versions
- Six rules have been added and two rules have been updated
Thanks to @r-sm2024 for their contribution in #2155 and their further work. And of course a big thanks to the community for reporting issues, participating in discussions, and supporting the capa tool and capa rules.
New Features
- regenerate ruleset cache automatically on source change (only in dev mode) #2133 @s-ff
- add landing page https://mandiant.github.io/capa/ @williballenthin #2310
- add rules website https://mandiant.github.io/capa/rules @DeeyaSingh #2310
- add .justfile @williballenthin #2325
- dynamic: add support for VMRay dynamic sandbox traces #2208 @mike-hunhoff @r-sm2024 @mr-tz
- cli: use modern terminal features to hyperlink to the rules website #2337 @williballenthin
- support analyzing BinExport2 files generated by Ghidra #1950 @williballenthin @mehunhoff @mr-tz
- add support for Android OS #1950 @williballenthin @mehunhoff @mr-tz
- add support for aarch64 architecture via BinExport2 backend #1950 @williballenthin @mehunhoff @mr-tz
New Rules (6)
- linking/static/minhook/linked-against-minhook [email protected]
- linking/static/sqlite3/linked-against-sqlcipher [email protected]
- host-interaction/network/traffic/filter/delete-network-filter-via-wfp-api [email protected]
- host-interaction/network/traffic/filter/enumerate-network-filters-via-wfp-api [email protected]
- nursery/check-thread-suspend-count-exceeded [email protected]
- nursery/create-thread-bypassing-process-freeze [email protected]
Bug Fixes
- fix duplicate features shown in vverbose mode @williballenthin #2323
- fix code path reference in linter @williballenthin #2350
capa explorer IDA Pro plugin
Raw diffs
Contributors
Assets 6
v7.2.0
capa v7.2.0 introduces a first version of capa explorer web: a web-based user interface to inspect capa results using your browser. Users can inspect capa result JSON documents in an online web instance or a standalone HTML page for offline usage. capa explorer supports interactive exploring of capa results to make it easier to understand them. Users can filter, sort, and see the details of all identified capabilities. capa explorer web was worked on by @s-ff as part of a GSoC project, and it is available at https://mandiant.github.io/capa/explorer/#/.
This release also adds a feature extractor for output from the DRAKVUF sandbox. Now, analysts can pass the resulting drakmon.log file to capa and extract capabilities from the artifacts captured by the sandbox. This feature extractor will also be added to the DRAKVUF sandbox as a post-processing script, and it was worked on by @yelhamer as part of a GSoC project.
Additionally, we fixed several bugs handling ELF files, and added the ability to filter capa analysis by functions or processes. We also added support to the IDA Pro extractor to leverage analyst recovered API names.
Special thanks to our repeat and new contributors:
- @lakshayletsgo for their first contribution in #2248
- @msm-cert for their first contribution in #2143
- @VascoSch92 for their first contribution in #2143
New Features
- webui: explore capa analysis results in a web-based UI online and offline #2224 @s-ff
- support analyzing DRAKVUF traces #2143 @yelhamer
- IDA extractor: extract names from dynamically resolved APIs stored in renamed global variables #2201 @Ana06
- cli: add the ability to select which specific functions or processes to analyze @yelhamer
Breaking Changes
New Rules (5)
- nursery/upload-file-to-onedrive [email protected] [email protected]
- data-manipulation/encoding/base64/decode-data-using-base64-via-vbmi-lookup-table [email protected]
- communication/socket/attach-bpf-to-socket-on-linux [email protected]
- anti-analysis/anti-av/overwrite-dll-text-section-to-remove-hooks [email protected]
- nursery/delete-file-on-linux [email protected]
Bug Fixes
- elf: extract import / export symbols from stripped binaries #2096 @ygasparis
- elf: fix handling of symbols in corrupt ELF files #2226 @williballenthin
capa explorer IDA Pro plugin
Development
- CI: use macos-12 since macos-11 is deprecated and will be removed on June 28th, 2024 #2173 @mr-tz
- CI: update Binary Ninja version to 4.1 and use Python 3.9 to test it #2211 @xusheng6
- CI: update tests.yml workflow to exclude web and documentation files #2263 @s-ff
- CI: update build.yml workflow to exclude web and documentation files #2270 @s-ff
Raw diffs
Contributors
Assets 6
v7.1.0
The v7.1.0 release brings large performance improvements to capa's rule matching engine.
Additionally, we've fixed various bugs and added new features for people using and developing capa.
This capa version now supports Python 3.12.
Special thanks to our repeat and new contributors:
- @sjha2048 made their first contribution in #2000
- @Rohit1123 made their first contribution in #1990
- @psahithireddy made their first contribution in #2020
- @Atlas-64 made their first contribution in #2018
- @s-ff made their first contribution in #2011
- @samadpls made their first contribution in #2024
- @acelynnzhang made their first contribution in #2044
- @RainRat made their first contribution in #2058
- @ReversingWithMe made their first contribution in #2093
- @malwarefrank made their first contribution in #2037
New Features
- Emit "dotnet" as format to ResultDocument when processing .NET files #2024 @samadpls
- ELF: detect OS from statically-linked Go binaries #1978 @williballenthin
- add function in capa/helpers to load plain and compressed JSON reports #1883 @Rohit1123
- document Antivirus warnings and VirusTotal false positive detections #2028 @RionEV @mr-tz
- Add json to sarif conversion script @ReversingWithMe
- render maec/* fields #843 @s-ff
- replace Halo spinner with Rich #2086 @s-ff
- optimize rule matching #2080 @williballenthin
- add aarch64 as a valid architecture #2144 [email protected] @williballenthin
- relax dependency version requirements for the capa library #2053 @williballenthin
- add scripts dependency group and update documentation #2145 @mr-tz
New Rules (25)
- impact/wipe-disk/delete-drive-layout-via-ioctl [email protected]
- host-interaction/driver/interact-with-driver-via-ioctl [email protected]
- host-interaction/driver/unload-driver [email protected]
- nursery/get-disk-information-via-ioctl [email protected]
- nursery/get-volume-information-via-ioctl [email protected]
- nursery/unmount-volume-via-ioctl [email protected]
- data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-systemfunction033 [email protected]
- anti-analysis/anti-forensic/self-deletion/self-delete-using-alternate-data-streams [email protected]
- nursery/change-memory-permission-on-linux [email protected]
- nursery/check-file-permission-on-linux [email protected]
- nursery/check-if-process-is-running-under-android-emulator-on-android [email protected]
- nursery/map-or-unmap-memory-on-linux [email protected]
- persistence/act-as-share-provider-dll [email protected]
- persistence/act-as-windbg-extension [email protected]
- persistence/act-as-time-provider-dll [email protected]
- host-interaction/gui/window/hide/hide-graphical-window-from-taskbar [email protected]
- compiler/dart/compiled-with-dart [email protected]
- nursery/bypass-hidden-api-restrictions-via-jni-on-android [email protected]
- nursery/get-current-process-filesystem-mounts-on-linux [email protected]
- nursery/get-current-process-memory-mapping-on-linux [email protected]
- nursery/get-system-property-on-android [email protected]
- nursery/hook-routines-via-lsplant [email protected]
- nursery/load-packed-dex-via-jiagu-on-android [email protected]
- nursery/modify-api-blacklist-or-denylist-via-jni-on-android [email protected]
- nursery/truncate-file-on-linux [email protected]
Bug Fixes
- do some imports closer to where they are used #1810 @williballenthin
- binja: fix and simplify stack string detection code after binja 4.0 @xusheng6
- binja: add support for forwarded export #1646 @xusheng6
- cape: support more report formats #2035 @mr-tz
capa explorer IDA Pro plugin
Development
- ci: Fix PR review in the changelog check GH action #2004 @Ana06
- ci: use rules number badge stored in our bot gist and generated using
schneegans/dynamic-badges-action#2001 capa-rules#882 @Ana06 - ci: update github workflows to use latest version of actions that were using a deprecated version of node #1967 #2003 capa-rules#883 @sjha2048 @Ana06
- ci: update binja version to stable 4.0 #2016 @xusheng6
- ci: update github workflows to reflect the latest ghidrathon installation and bumped up jep, ghidra versions #2020 @psahithireddy
- ci: include rule caching in PyInstaller build process #2097 @s-ff
- add deptry support #1497 @s-ff
Raw diffs
Contributors
Assets 6
v7.0.1
This release fixes a circular import error when using capa as a library.
Bug Fixes
- fix potentially circular import errors #1969 @williballenthin
Raw diffs
Contributors
Assets 6
v7.0.0
This is the v7.0.0 release of capa which was mainly worked on during the Google Summer of Code (GSoC) 2023. A huge
shoutout to our GSoC contributors @colton-gabertan and @yelhamer for their amazing work. See our blog posts for more details:
Also, a big thanks to the other contributors: @aaronatp, @Aayush-Goel-04, @bkojusner, @doomedraven, @ruppde, @larchchen, @JCoonradt, and @xusheng6.
New Features
- add Ghidra backend #1770 #1767 @colton-gabertan @mike-hunhoff
- add Ghidra UI integration #1734 @colton-gabertan @mike-hunhoff
- add dynamic analysis via CAPE sandbox reports #48 #1535 @yelhamer
- binja: add support for forwarded exports #1646 @xusheng6
- binja: add support for symtab names #1504 @xusheng6
- add com class/interface features #322 @Aayush-Goel-04
- dotnet: emit enclosing class information for nested classes #1780 #1913 @bkojusner @mike-hunhoff
Breaking Changes
- remove the
SCOPE_*constants in favor of theScopeenum #1764 @williballenthin - protobuf: deprecate
RuleMetadata.scopein favor ofRuleMetadata.scopes@williballenthin - protobuf: deprecate
Metadata.analysisin favor ofMetadata.analysis2that is dynamic analysis aware @williballenthin - update freeze format to v3, adding support for dynamic analysis @williballenthin
- extractor: ignore DLL name for api features #1815 @mr-tz
- main: introduce wrapping routines within main for working with CLI args #1813 @williballenthin
- move functions from
capa.mainto newcapa.loadernamespace #1821 @williballenthin - proto: add
packagedeclaration #1960 @larchchen
New Rules (41)
- nursery/get-ntoskrnl-base-address @mr-tz
- host-interaction/network/connectivity/set-tcp-connection-state @johnk3r
- nursery/capture-process-snapshot-data @mr-tz
- collection/network/capture-packets-using-sharppcap [email protected]
- nursery/communicate-with-kernel-module-via-netlink-socket-on-linux [email protected]
- nursery/get-current-pid-on-linux [email protected]
- nursery/get-file-system-information-on-linux [email protected]
- nursery/get-password-database-entry-on-linux [email protected]
- nursery/mark-thread-detached-on-linux [email protected]
- nursery/persist-via-gnome-autostart-on-linux [email protected]
- nursery/set-thread-name-on-linux [email protected]
- load-code/dotnet/load-windows-common-language-runtime [email protected] [email protected] [email protected]
- nursery/log-keystrokes-via-input-method-manager @mr-tz
- nursery/encrypt-data-using-rc4-via-systemfunction032 [email protected]
- nursery/add-value-to-global-atom-table @mr-tz
- nursery/enumerate-processes-that-use-resource @Ana06
- host-interaction/process/inject/allocate-or-change-rwx-memory @mr-tz
- lib/allocate-or-change-rw-memory [email protected] @mr-tz
- lib/change-memory-protection @mr-tz
- anti-analysis/anti-av/patch-antimalware-scan-interface-function [email protected]
- executable/dotnet-singlefile/bundled-with-dotnet-single-file-deployment [email protected]
- internal/limitation/file/internal-dotnet-single-file-deployment-limitation [email protected]
- data-manipulation/encoding/encode-data-using-add-xor-sub-operations [email protected]
- nursery/access-camera-in-dotnet-on-android [email protected]
- nursery/capture-microphone-audio-in-dotnet-on-android [email protected]
- nursery/capture-screenshot-in-dotnet-on-android [email protected]
- nursery/check-for-incoming-call-in-dotnet-on-android [email protected]
- nursery/check-for-outgoing-call-in-dotnet-on-android [email protected]
- nursery/compiled-with-xamarin [email protected]
- nursery/get-os-version-in-dotnet-on-android [email protected]
- data-manipulation/compression/create-cabinet-on-windows [email protected] [email protected]
- data-manipulation/compression/extract-cabinet-on-windows [email protected]
- lib/create-file-decompression-interface-context-on-windows [email protected]
- nursery/enumerate-files-in-dotnet [email protected] [email protected]
- nursery/get-mac-address-in-dotnet [email protected] [email protected] [email protected]
- nursery/get-current-process-command-line [email protected]
- nursery/get-current-process-file-path [email protected]
- nursery/hook-routines-via-dlsym-rtld_next [email protected]
- nursery/linked-against-hp-socket [email protected]
- host-interaction/process/inject/process-ghostly-hollowing [email protected]
Bug Fixes
- ghidra: fix
ints_to_bytesperformance #1761 @mike-hunhoff - binja: improve function call site detection @xusheng6
- binja: use
binaryninja.loadto open files @xusheng6 - binja: bump binja version to 3.5 #1789 @xusheng6
- elf: better detect ELF OS via GCC .ident directives #1928 @williballenthin
- elf: better detect ELF OS via Android dependencies #1947 @williballenthin
- fix setuptools package discovery #1886 @gmacon @mr-tz
- remove unnecessary scripts/vivisect-py2-vs-py3.sh file #1949 @JCoonradt
capa explorer IDA Pro plugin
- various integration updates and minor bug fixes
Development
Developer Notes
With this new release, many classes and concepts have been split up into static (mostly identical to the
prior implementations) and dynamic ones. For example, the legacy FeatureExtractor class has been renamed to
StaticFeatureExtractor and the DynamicFeatureExtractor has been added.
Starting from version 7.0, we have moved the component responsible for feature extractor from main to a new
capabilities' module. Now, users wishing to utilize capa’s feature extraction abilities should use that module instead
of importing the relevant logic from the main file.
For sandbox-based feature extractors, we are using Pydantic models. Contributions of more models for other sandboxes
are very welcome!
With this release we've reorganized the logic found in main() to localize logic and ease readability and ease changes
and integrations. The new "main routines" are expected to be used only within main functions, either capa main or
related scripts. These functions should not be invoked from library code.
Beyond copying code around, we've refined the handling of the input file/format/backend. The logic for picking the
format and backend is more consistent. We've documented that the input file is not necessarily the sample itself
(cape/freeze/etc.) inputs are not actually the sample.
Raw diffs
Contributors
Assets 6
v7.0.0-beta
This is the beta release of capa v7.0 which was mainly worked on during the Google Summer of Code (GSoC) 2023. A huge
shoutout to @colton-gabertan and @yelhamer for their amazing work.
Also a big thanks to the other contributors: @aaronatp, @Aayush-Goel-04, @bkojusner, @doomedraven, @ruppde, and @xusheng6.
New Features
- add Ghidra backend #1770 #1767 @colton-gabertan @mike-hunhoff
- add dynamic analysis via CAPE sandbox reports #48 #1535 @yelhamer
- binja: add support for forwarded exports #1646 @xusheng6
- binja: add support for symtab names #1504 @xusheng6
- add com class/interface features #322 @Aayush-Goel-04
- dotnet: emit enclosing class information for nested classes #1780 #1913 @bkojusner @mike-hunhoff
Breaking Changes
- remove the
SCOPE_*constants in favor of theScopeenum #1764 @williballenthin - protobuf: deprecate
RuleMetadata.scopein favor ofRuleMetadata.scopes@williballenthin - protobuf: deprecate
Metadata.analysisin favor ofMetadata.analysis2that is dynamic analysis aware @williballenthin - update freeze format to v3, adding support for dynamic analysis @williballenthin
- extractor: ignore DLL name for api features #1815 @mr-tz
New Rules (41)
- nursery/get-ntoskrnl-base-address @mr-tz
- host-interaction/network/connectivity/set-tcp-connection-state @johnk3r
- nursery/capture-process-snapshot-data @mr-tz
- collection/network/capture-packets-using-sharppcap [email protected]
- nursery/communicate-with-kernel-module-via-netlink-socket-on-linux [email protected]
- nursery/get-current-pid-on-linux [email protected]
- nursery/get-file-system-information-on-linux [email protected]
- nursery/get-password-database-entry-on-linux [email protected]
- nursery/mark-thread-detached-on-linux [email protected]
- nursery/persist-via-gnome-autostart-on-linux [email protected]
- nursery/set-thread-name-on-linux [email protected]
- load-code/dotnet/load-windows-common-language-runtime [email protected] [email protected] [email protected]
- nursery/log-keystrokes-via-input-method-manager @mr-tz
- nursery/encrypt-data-using-rc4-via-systemfunction032 [email protected]
- nursery/add-value-to-global-atom-table @mr-tz
- nursery/enumerate-processes-that-use-resource @Ana06
- host-interaction/process/inject/allocate-or-change-rwx-memory @mr-tz
- lib/allocate-or-change-rw-memory [email protected] @mr-tz
- lib/change-memory-protection @mr-tz
- anti-analysis/anti-av/patch-antimalware-scan-interface-function [email protected]
- executable/dotnet-singlefile/bundled-with-dotnet-single-file-deployment [email protected]
- internal/limitation/file/internal-dotnet-single-file-deployment-limitation [email protected]
- data-manipulation/encoding/encode-data-using-add-xor-sub-operations [email protected]
- nursery/access-camera-in-dotnet-on-android [email protected]
- nursery/capture-microphone-audio-in-dotnet-on-android [email protected]
- nursery/capture-screenshot-in-dotnet-on-android [email protected]
- nursery/check-for-incoming-call-in-dotnet-on-android [email protected]
- nursery/check-for-outgoing-call-in-dotnet-on-android [email protected]
- nursery/compiled-with-xamarin [email protected]
- nursery/get-os-version-in-dotnet-on-android [email protected]
- data-manipulation/compression/create-cabinet-on-windows [email protected] [email protected]
- data-manipulation/compression/extract-cabinet-on-windows [email protected]
- lib/create-file-decompression-interface-context-on-windows [email protected]
- nursery/enumerate-files-in-dotnet [email protected] [email protected]
- nursery/get-mac-address-in-dotnet [email protected] [email protected] [email protected]
- nursery/get-current-process-command-line [email protected]
- nursery/get-current-process-file-path [email protected]
- nursery/hook-routines-via-dlsym-rtld_next [email protected]
- nursery/linked-against-hp-socket [email protected]
- host-interaction/process/inject/process-ghostly-hollowing [email protected]
Bug Fixes
- ghidra: fix
ints_to_bytesperformance #1761 @mike-hunhoff - binja: improve function call site detection @xusheng6
- binja: use
binaryninja.loadto open files @xusheng6 - binja: bump binja version to 3.5 #1789 @xusheng6
- elf: better detect ELF OS via GCC .ident directives #1928 @williballenthin
- fix setuptools package discovery #1886 @gmacon @mr-tz
Development
Developer Notes
With this new release, many classes and concepts have been split up into static (mostly identical to the
prior implementations) and dynamic ones. For example, the legacy FeatureExtractor class has been renamed to
StaticFeatureExtractor and the DynamicFeatureExtractor has been added.
Starting from version 7.0, we have moved the component responsible for feature extractor from main to a new
capabilities' module. Now, users wishing to utilize capa’s feature extraction abilities should use that module instead
of importing the relevant logic from the main file.
For sandbox-based feature extractors, we are using Pydantic models. Contributions of more models for other sandboxes
are very welcome!
Raw diffs
Contributors
Assets 6
v6.1.0
capa v6.1.0 is a bug fix release, most notably fixing unhandled exceptions in the capa explorer IDA Pro plugin. @Aayush-Goel-04 put a lot of effort into improving code quality and adding a script for rule authors. The script shows which features are present in a sample but not referenced by any existing rule. You could use this script to find opportunities for new rules.
Speaking of new rules, we have eight additions, coming from Ronnie, Jakub, Moritz, Ervin, and [email protected]!
New Features
- ELF: implement import and export name extractor #1607 #1608 @Aayush-Goel-04
- bump pydantic from 1.10.9 to 2.1.1 #1582 @Aayush-Goel-04
- develop script to highlight features not used during matching #331 @Aayush-Goel-04
New Rules (8)
- executable/pe/export/forwarded-export [email protected]
- host-interaction/bootloader/get-uefi-variable [email protected]
- host-interaction/bootloader/set-uefi-variable [email protected]
- nursery/enumerate-device-drivers-on-linux @mr-tz
- anti-analysis/anti-vm/vm-detection/check-for-foreground-window-switch [email protected]
- linking/static/sqlite3/linked-against-cppsqlite3 [email protected]
- linking/static/sqlite3/linked-against-sqlite3 [email protected]
Modified rules (9)
- anti-analysis/anti-forensic/self-deletion/self-delete.yml
- collection/browser/gather-chrome-based-browser-login-information.yml
- collection/browser/gather-firefox-profile-information.yml
- data-manipulation/encoding/base64/decode-data-using-base64-via-dword-translation-table.yml
- host-interaction/process/inject/free-user-process-memory.yml
- lib/get-os-version.yml
- nursery/deserialize-json-in-dotnet.yml
- nursery/serialize-json-in-dotnet.yml
- persistence/authentication-process/act-as-credential-manager-dll.yml
Renamed rules (1)
Bug Fixes
- rules: fix forwarded export characteristic #1656 @RonnieSalomonsen
- Binary Ninja: Fix stack string detection #1473 @xusheng6
- linter: skip native API check for NtProtectVirtualMemory #1675 @williballenthin
- OS: detect Android ELF files #1705 @williballenthin
- ELF: fix parsing of symtab #1704 @williballenthin
- result document: don't use deprecated pydantic functions #1718 @williballenthin
- pytest: don't mark IDA tests as pytest tests #1719 @williballenthin
capa explorer IDA Pro plugin
- fix unhandled exception when resolving rule path #1693 @mike-hunhoff
EDIT: a standalone binary created using Python 3.11 is now available.
Raw diffs
Contributors
Assets 6
v6.0.0
v6.0.0
capa v6.0 brings many bug fixes and quality improvements, including 64 rule updates and 26 new rules. We're now publishing to PyPI via Trusted Publishing and have migrated to using a pyproject.toml file. @Aayush-Goel-04 contributed a lot of new code across many files, so please welcome them to the project, along with @anders-v @crowface28 @dkelly2e @RonnieSalomonsen and @ejfocampo as first-time rule contributors!
For those that use capa as a library, we've introduced some limited breaking changes that better represent data types (versus less-structured data like dictionaries and strings). With the recent deprecation, we've also dropped support for Python 3.7.
New Features
- add script to detect feature overlap between new and existing capa rules #1451 @Aayush-Goel-04
- extract forwarded exports from PE files #1624 @williballenthin
- extract function and API names from ELF symtab entries @yelhamer mandiant/capa-rules#736
- use fancy box drawing characters for default output #1586 @williballenthin
Breaking Changes
- use a class to represent Metadata (not dict) #1411 @Aayush-Goel-04 @manasghandat
- use pathlib.Path to represent file paths #1534 @Aayush-Goel-04
- Python 3.8 is now the minimum supported Python version #1578 @williballenthin
- Require a Contributor License Agreement (CLA) for PRs going forward #1642 @williballenthin
New Rules (26)
- load-code/shellcode/execute-shellcode-via-windows-callback-function [email protected] [email protected]
- nursery/execute-shellcode-via-indirect-call [email protected]
- data-manipulation/encryption/aes/encrypt-data-using-aes-mixcolumns-step @mr-tz
- linking/static/aplib/linked-against-aplib [email protected]
- communication/mailslot/read-from-mailslot [email protected]
- nursery/hash-data-using-sha512managed-in-dotnet [email protected]
- nursery/compiled-with-exescript [email protected]
- nursery/check-for-sandbox-via-mac-address-ouis-in-dotnet [email protected]
- host-interaction/hardware/enumerate-devices-by-category @mr-tz
- host-interaction/service/continue-service @mr-tz
- host-interaction/service/pause-service @mr-tz
- persistence/exchange/act-as-exchange-transport-agent [email protected]
- host-interaction/file-system/create-virtual-file-system-in-dotnet [email protected]
- compiler/cx_freeze/compiled-with-cx_freeze @mr-tz [email protected]
- communication/socket/create-vmci-socket [email protected]
- persistence/office/act-as-excel-xll-add-in [email protected]
- persistence/office/act-as-office-com-add-in [email protected]
- persistence/office/act-as-word-wll-add-in [email protected]
- anti-analysis/anti-debugging/debugger-evasion/hide-thread-from-debugger [email protected] [email protected]
- host-interaction/memory/create-new-application-domain-in-dotnet [email protected]
- host-interaction/gui/switch-active-desktop [email protected]
- host-interaction/service/query-service-configuration @mr-tz
- anti-analysis/anti-av/patch-event-tracing-for-windows-function [email protected]
- data-manipulation/encoding/xor/covertly-decode-and-write-data-to-windows-directory-using-indirect-calls [email protected]
- linking/runtime-linking/resolve-function-by-brute-ratel-badger-hash [email protected]
Bug Fixes
- extractor: add a Binary Ninja test that asserts its version #1487 @xusheng6
- extractor: update Binary Ninja stack string detection after the new constant outlining feature #1473 @xusheng6
- extractor: update vivisect Arch extraction #1334 @mr-tz
- extractor: avoid Binary Ninja exception when analyzing certain files #1441 @xusheng6
- symtab: fix struct.unpack() format for 64-bit ELF files @yelhamer
- symtab: safeguard against ZeroDivisionError for files containing a symtab with a null entry size @yelhamer
- improve ELF strtab and needed parsing @mr-tz
- better handle exceptional cases when parsing ELF files #1458 @Aayush-Goel-04
- improved testing coverage for Binary Ninja backend #1446 @Aayush-Goel-04
- add logging and print redirect to tqdm for capa main #749 @Aayush-Goel-04
- extractor: fix binja installation path detection does not work with Python 3.11
- tests: refine the IDA test runner script #1513 @williballenthin
- output: don't leave behind traces of progress bar @williballenthin
- import-to-ida: fix bug introduced with JSON report changes in v5 #1584 @williballenthin
- main: don't show spinner when emitting debug messages #1636 @williballenthin
capa explorer IDA Pro plugin
Development
- update ATT&CK/MBC data for linting #1568 @mr-tz
- log time taken to analyze each function #1290 @williballenthin
- tests: make fixture available via conftest.py #1592 @williballenthin
- publish via PyPI trusted publishing #1491 @williballenthin
- migrate to pyproject.toml #1301 @williballenthin
- use pre-commit to invoke linters #1579 @williballenthin
Raw diffs
Contributors
Assets 5
v5.1.0
capa version 5.1.0 adds a Protocol Buffers (protobuf) format for result documents. Additionally, the Vector35 team contributed a new feature extractor using Binary Ninja. Other new features are a new CLI flag to override the detected operating system, functionality to read and render existing result documents, and a output color format that's easier to read.
Over 25 capa rules have been added and improved.
Thanks for all the support, especially to @xusheng6, @captainGeech42, @ggold7046, @manasghandat, @ooprathamm, @linpeiyu164, @yelhamer, @HongThatCong, @naikordian, @stevemk14ebr, @emtuls, @raymondlleong, @bkojusner, @joren485, and everyone else who submitted bugs and provided feedback!
New Features
- add protobuf format for result documents #1219 @williballenthin @mr-tz
- extractor: add Binary Ninja feature extractor @xusheng6
- new cli flag
--osto override auto-detected operating system for a sample @captainGeech42 - change colour/highlight to "cyan" instead of "blue" for better readability #1384 @ggold7046
- add new format to parse output json back to capa #1396 @ooprathamm
- parse ELF symbols' names to guess OS #1403 @yelhamer
New Rules (26)
- persistence/scheduled-tasks/schedule-task-via-at joren485
- data-manipulation/prng/generate-random-numbers-via-rtlgenrandom [email protected]
- communication/ip/convert-ip-address-from-string @mr-tz
- data-manipulation/compression/compress-data-via-zlib-inflate-or-deflate [email protected]
- executable/installer/dotnet/packaged-as-single-file-dotnet-application [email protected]
- communication/socket/create-raw-socket [email protected]
- communication/http/reference-http-user-agent-string @mr-tz
- communication/http/get-http-content-length [email protected]
- nursery/move-directory [email protected]
- nursery/get-http-request-uri [email protected]
- nursery/create-zip-archive-in-dotnet [email protected]
- nursery/extract-zip-archive-in-dotnet [email protected] [email protected]
- data-manipulation/encryption/tea/decrypt-data-using-tea [email protected] [email protected]
- data-manipulation/encryption/tea/encrypt-data-using-tea [email protected] [email protected]
- data-manipulation/encryption/xtea/encrypt-data-using-xtea [email protected]
- data-manipulation/encryption/xxtea/encrypt-data-using-xxtea [email protected]
- nursery/hash-data-using-ripemd128 [email protected]
- nursery/hash-data-using-ripemd256 [email protected]
- nursery/hash-data-using-ripemd320 [email protected]
- nursery/set-web-proxy-in-dotnet [email protected]
- nursery/check-for-windows-sandbox-via-subdirectory [email protected]
- nursery/enumerate-pe-sections-in-dotnet @mr-tz
- nursery/destroy-software-breakpoint-capability [email protected]
- nursery/send-data-to-internet [email protected]
- nursery/compiled-with-cx_freeze @mr-tz
- nursery/contain-a-thread-local-storage-tls-section-in-dotnet [email protected]
Bug Fixes
- extractor: removed '.dynsym' as the library name for ELF imports #1318 @stevemk14ebr
- extractor: fix vivisect loop detection corner case #1310 @mr-tz
- match: extend OS characteristic to match OS_ANY to all supported OSes #1324 @mike-hunhoff
- extractor: fix IDA and vivisect string and bytes features overlap and tests #1327 #1336 @xusheng6
capa explorer IDA Pro plugin
- fix exception when plugin loaded in IDA hosted under idat #1341 @mike-hunhoff
- improve embedded PE detection performance and reduce FP potential #1344 @mike-hunhoff
