Releases: mandiant/capa
v8.0.1
This point release fixes an issue with the IDAPython API to now handle IDA Pro 8.3, 8.4, and 9.0 correctly.
Bug Fixes
- handle IDA 8.3/8.4 vs. 9.0 API change @mr-tz
Raw diffs
Contributors
Assets 6
v8.0.0
capa version 8 adds support for IDA Pro 9.0 (and idalib). The release comes with various improvements and bug fixes for the Binary Ninja backend (including to load with database files) -- thanks to @xusheng6.
Additional bug fixes improve the dynamic and BinExport backends.
capa version 8 now requires Python 3.10 or newer.
Special thanks to @Tamir-K, @harshit-wadhwani, @jorik-utwente for their great contributions.
New Features
- allow call as valid subscope for call scoped rules @mr-tz
- support loading and analyzing a Binary Ninja database #2496 @xusheng6
- vmray: record process command line details @mr-tz
Breaking Changes
New Rules (54)
- nursery/get-shadow-password-file-entry-on-linux [email protected]
- nursery/set-shadow-password-file-entry-on-linux [email protected]
- collection/browser/get-chrome-cookiemonster [email protected]
- collection/browser/get-elevation-service-for-chromium-based-browsers [email protected]
- collection/get-steam-token [email protected]
- nursery/persist-via-application-shimming [email protected]
- nursery/persist-via-bits-job [email protected]
- nursery/persist-via-print-processors-registry-key [email protected]
- linking/static/touchsocket/linked-against-touchsocket [email protected]
- runtime/dotnet/compiled-with-dotnet-aot [email protected]
- nursery/persist-via-errorhandler-script [email protected]
- nursery/persist-via-get-variable-hijack [email protected]
- nursery/persist-via-iphlpapi-dll-hijack [email protected]
- nursery/persist-via-lnk-shortcut [email protected]
- nursery/persist-via-powershell-profile [email protected]
- nursery/persist-via-windows-accessibility-tools [email protected]
- nursery/persist-via-windows-terminal-profile [email protected]
- nursery/write-to-browser-extension-directory [email protected]
- nursery/persist-via-aedebug-registry-key [email protected]
- nursery/persist-via-amsi-registry-key [email protected]
- nursery/persist-via-app-paths-registry-key [email protected]
- nursery/persist-via-appcertdlls-registry-key [email protected]
- nursery/persist-via-appx-registry-key [email protected]
- nursery/persist-via-autodialdll-registry-key [email protected]
- nursery/persist-via-autoplayhandlers-registry-key [email protected]
- nursery/persist-via-bootverificationprogram-registry-key [email protected]
- nursery/persist-via-code-signing-registry-key [email protected]
- nursery/persist-via-com-hijack [email protected]
- nursery/persist-via-command-processor-registry-key [email protected]
- nursery/persist-via-contextmenuhandlers-registry-key [email protected]
- nursery/persist-via-cor_profiler_path-registry-value [email protected]
- nursery/persist-via-default-file-association-registry-key [email protected]
- nursery/persist-via-disk-cleanup-handler-registry-key [email protected]
- nursery/persist-via-dotnet-dbgmanageddebugger-registry-key [email protected]
- nursery/persist-via-dotnet_startup_hooks-registry-key [email protected]
- nursery/persist-via-explorer-tools-registry-key [email protected]
- nursery/persist-via-filter-handlers-registry-key [email protected]
- nursery/persist-via-group-policy-registry-key [email protected]
- nursery/persist-via-hhctrl-com-hijack [email protected]
- nursery/persist-via-htmlhelp-author-registry-key [email protected]
- nursery/persist-via-image-file-execution-options-registry-key [email protected]
- nursery/persist-via-lsa-registry-key [email protected]
- nursery/persist-via-natural-language-registry-key [email protected]
- nursery/persist-via-netsh-registry-key [email protected]
- nursery/persist-via-network-provider-registry-key [email protected]
- nursery/persist-via-path-registry-key [email protected]
- nursery/persist-via-print-monitors-registry-key [email protected]
- nursery/persist-via-rdp-startup-programs-registry-key [email protected]
- nursery/persist-via-silentprocessexit-registry-key [email protected]
- nursery/persist-via-telemetrycontroller-registry-key [email protected]
- nursery/persist-via-timeproviders-registry-key [email protected]
- nursery/persist-via-ts-initialprogram-registry-key [email protected]
- nursery/persist-via-userinitmprlogonscript-registry-value [email protected]
- nursery/persist-via-windows-error-reporting-registry-key [email protected]
Bug Fixes
- extractor: fix exception when PE extractor encounters unknown architecture #2440 @Tamir-K
- IDA Pro: rename ida to idapro module for plugin and idalib in IDA 9.0 #2453 @mr-tz
- ghidra: fix saving of base address @mr-tz
- binja: support loading raw x86/x86_64 shellcode #2489 @xusheng6
- binja: fix crash when the IL of certain functions are not available. #2249 @xusheng6
- binja: major performance improvement on the binja extractor. #1414 @xusheng6
- cape: make Process model flexible and procmemory optional to load newest reports #2466 @mr-tz
- binja: fix unit test failure by fixing up the analysis for file al-khaser_x64.exe_ #2507 @xusheng6
- binja: move the stack string detection to function level #2516 @xusheng6
- BinExport2: fix handling of incorrect thunk functions #2524 @williballenthin
- BinExport2: more precise pruning of expressions @williballenthin
- BinExport2: better handle weird expression trees from Ghidra #2528 #2530 @williballenthin
capa Explorer Web
capa Explorer IDA Pro plugin
Development
- CI: use macos-13 since macos-12 is deprecated and will be removed on December 3rd, 2024 #2173 @mr-tz
- CI: update Binary Ninja version to 4.2 #2499 @xusheng6
Raw diffs
Contributors
Assets 6
v7.4.0
The v7.4.0 capa release fixes a bug when processing VMRay analysis archives and enhances API extraction for all dynamic backends. For better terminal rendering capa now solely relies on the rich library.
The standalone capa executable can now automatically detect installations of relevant third party applications and use their backends (notably, idalib and Binary Ninja). For the extra standalone Linux build we've upgraded from Python 3.11 to 3.12.
Twelve new rules have been added. Thanks to all the contributors!
This is the last capa version supporting Python 3.8 and 3.9. If you have major concerns about this please reach out to us.
New Features
- add IDA v9.0 backend via idalib #2376 @williballenthin
- locate Binary Ninja API using XDG Desktop Entries #2376 @williballenthin
New Rules (15)
- nursery/access-unmanaged-com-objects-in-dotnet [email protected]
- nursery/implement-ui-automation-client-in-dotnet [email protected]
- nursery/interact-with-shortcut-via-iwshshortcut-in-dotnet [email protected]
- nursery/interact-with-windows-scripting-host-in-dotnet [email protected]
- nursery/use-dotnet-library-simplejson [email protected]
- nursery/use-dotnet-library-websocket-sharp [email protected]
- linking/runtime-linking/populate-syswhispers2-syscall-list [email protected]
- host-interaction/os/hide-shutdown-actions-via-policy [email protected]
- host-interaction/process/get-process-filename [email protected]
- host-interaction/driver/complete-processing-asynchronous-io-request [email protected]
- anti-analysis/packer/nmm-protect/packed-with-nmm-protect [email protected]
- host-interaction/firewall/modify/access-firewall-policy-via-inetfwpolicy2 [email protected]
- host-interaction/firewall/modify/access-firewall-rule-properties-via-inetfwrule [email protected]
- host-interaction/registry/open-recentdocs-registry-key [email protected]
Bug Fixes
- use Python 3.12 to build extra standalone build on Linux #2383 @williballenthin
- bump minimum Python version to 3.8.1 to satisfy uv #2387 @williballenthin
- vmray: collect more process information from flog.xml #2394 @mr-tz @mike-hunhoff
- replace tabulate, tqdm, and termcolor with rich #2374 @s-ff
- dynamic: emit complete features for A/W APIs #2409 @mike-hunhoff
- vmray: fix backslash handling in string call arguments #2428 @mr-tz
capa Explorer Web
Raw diffs
Contributors
Assets 6
v7.3.0
The v7.3.0 capa release comes with the following three major enhancements:
1. Support for VMRay sandbox analysis archives
Unlock powerful malware analysis with capa's new VMRay sandbox integration! Simply provide a VMRay analysis archive, and capa will automatically extract and match capabilities to streamline your workflow. This is the second support for the analysis of dynamic analysis results after CAPE.
2. Support for BinExport files generated by Ghidra
BinExport files store disassembled data into a Protocol Buffer format. capa now supports the analysis of BinExport files generated by Ghidra. Using Ghidra and the BinExport file format users can now analyze ARM (AARCH64) ELF files targeting Android.
3. Introducing the capa rules website
You can now browse capa's default rule set at https://mandiant.github.io/capa/rules. In modern terminals the CLI capa tool hyperlinks to resources on the web, including entries on the capa rules website.
Furthermore, https://mandiant.github.io/capa provides a landing page for the capa tool project.
Additional updates
- capa Explorer Web received several enhancements and bug fixes.
- Support for the IDA Pro 9.0 IDAPython API while keeping compatibility to older IDA Pro versions
- Six rules have been added and two rules have been updated
Thanks to @r-sm2024 for their contribution in #2155 and their further work. And of course a big thanks to the community for reporting issues, participating in discussions, and supporting the capa tool and capa rules.
New Features
- regenerate ruleset cache automatically on source change (only in dev mode) #2133 @s-ff
- add landing page https://mandiant.github.io/capa/ @williballenthin #2310
- add rules website https://mandiant.github.io/capa/rules @DeeyaSingh #2310
- add .justfile @williballenthin #2325
- dynamic: add support for VMRay dynamic sandbox traces #2208 @mike-hunhoff @r-sm2024 @mr-tz
- cli: use modern terminal features to hyperlink to the rules website #2337 @williballenthin
- support analyzing BinExport2 files generated by Ghidra #1950 @williballenthin @mehunhoff @mr-tz
- add support for Android OS #1950 @williballenthin @mehunhoff @mr-tz
- add support for aarch64 architecture via BinExport2 backend #1950 @williballenthin @mehunhoff @mr-tz
New Rules (6)
- linking/static/minhook/linked-against-minhook [email protected]
- linking/static/sqlite3/linked-against-sqlcipher [email protected]
- host-interaction/network/traffic/filter/delete-network-filter-via-wfp-api [email protected]
- host-interaction/network/traffic/filter/enumerate-network-filters-via-wfp-api [email protected]
- nursery/check-thread-suspend-count-exceeded [email protected]
- nursery/create-thread-bypassing-process-freeze [email protected]
Bug Fixes
- fix duplicate features shown in vverbose mode @williballenthin #2323
- fix code path reference in linter @williballenthin #2350
capa explorer IDA Pro plugin
Raw diffs
Contributors
Assets 6
v7.2.0
capa v7.2.0 introduces a first version of capa explorer web: a web-based user interface to inspect capa results using your browser. Users can inspect capa result JSON documents in an online web instance or a standalone HTML page for offline usage. capa explorer supports interactive exploring of capa results to make it easier to understand them. Users can filter, sort, and see the details of all identified capabilities. capa explorer web was worked on by @s-ff as part of a GSoC project, and it is available at https://mandiant.github.io/capa/explorer/#/.
This release also adds a feature extractor for output from the DRAKVUF sandbox. Now, analysts can pass the resulting drakmon.log file to capa and extract capabilities from the artifacts captured by the sandbox. This feature extractor will also be added to the DRAKVUF sandbox as a post-processing script, and it was worked on by @yelhamer as part of a GSoC project.
Additionally, we fixed several bugs handling ELF files, and added the ability to filter capa analysis by functions or processes. We also added support to the IDA Pro extractor to leverage analyst recovered API names.
Special thanks to our repeat and new contributors:
- @lakshayletsgo for their first contribution in #2248
- @msm-cert for their first contribution in #2143
- @VascoSch92 for their first contribution in #2143
New Features
- webui: explore capa analysis results in a web-based UI online and offline #2224 @s-ff
- support analyzing DRAKVUF traces #2143 @yelhamer
- IDA extractor: extract names from dynamically resolved APIs stored in renamed global variables #2201 @Ana06
- cli: add the ability to select which specific functions or processes to analyze @yelhamer
Breaking Changes
New Rules (5)
- nursery/upload-file-to-onedrive [email protected] [email protected]
- data-manipulation/encoding/base64/decode-data-using-base64-via-vbmi-lookup-table [email protected]
- communication/socket/attach-bpf-to-socket-on-linux [email protected]
- anti-analysis/anti-av/overwrite-dll-text-section-to-remove-hooks [email protected]
- nursery/delete-file-on-linux [email protected]
Bug Fixes
- elf: extract import / export symbols from stripped binaries #2096 @ygasparis
- elf: fix handling of symbols in corrupt ELF files #2226 @williballenthin
capa explorer IDA Pro plugin
Development
- CI: use macos-12 since macos-11 is deprecated and will be removed on June 28th, 2024 #2173 @mr-tz
- CI: update Binary Ninja version to 4.1 and use Python 3.9 to test it #2211 @xusheng6
- CI: update tests.yml workflow to exclude web and documentation files #2263 @s-ff
- CI: update build.yml workflow to exclude web and documentation files #2270 @s-ff
Raw diffs
Contributors
Assets 6
v7.1.0
The v7.1.0 release brings large performance improvements to capa's rule matching engine.
Additionally, we've fixed various bugs and added new features for people using and developing capa.
This capa version now supports Python 3.12.
Special thanks to our repeat and new contributors:
- @sjha2048 made their first contribution in #2000
- @Rohit1123 made their first contribution in #1990
- @psahithireddy made their first contribution in #2020
- @Atlas-64 made their first contribution in #2018
- @s-ff made their first contribution in #2011
- @samadpls made their first contribution in #2024
- @acelynnzhang made their first contribution in #2044
- @RainRat made their first contribution in #2058
- @ReversingWithMe made their first contribution in #2093
- @malwarefrank made their first contribution in #2037
New Features
- Emit "dotnet" as format to ResultDocument when processing .NET files #2024 @samadpls
- ELF: detect OS from statically-linked Go binaries #1978 @williballenthin
- add function in capa/helpers to load plain and compressed JSON reports #1883 @Rohit1123
- document Antivirus warnings and VirusTotal false positive detections #2028 @RionEV @mr-tz
- Add json to sarif conversion script @ReversingWithMe
- render maec/* fields #843 @s-ff
- replace Halo spinner with Rich #2086 @s-ff
- optimize rule matching #2080 @williballenthin
- add aarch64 as a valid architecture #2144 [email protected] @williballenthin
- relax dependency version requirements for the capa library #2053 @williballenthin
- add scripts dependency group and update documentation #2145 @mr-tz
New Rules (25)
- impact/wipe-disk/delete-drive-layout-via-ioctl [email protected]
- host-interaction/driver/interact-with-driver-via-ioctl [email protected]
- host-interaction/driver/unload-driver [email protected]
- nursery/get-disk-information-via-ioctl [email protected]
- nursery/get-volume-information-via-ioctl [email protected]
- nursery/unmount-volume-via-ioctl [email protected]
- data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-systemfunction033 [email protected]
- anti-analysis/anti-forensic/self-deletion/self-delete-using-alternate-data-streams [email protected]
- nursery/change-memory-permission-on-linux [email protected]
- nursery/check-file-permission-on-linux [email protected]
- nursery/check-if-process-is-running-under-android-emulator-on-android [email protected]
- nursery/map-or-unmap-memory-on-linux [email protected]
- persistence/act-as-share-provider-dll [email protected]
- persistence/act-as-windbg-extension [email protected]
- persistence/act-as-time-provider-dll [email protected]
- host-interaction/gui/window/hide/hide-graphical-window-from-taskbar [email protected]
- compiler/dart/compiled-with-dart [email protected]
- nursery/bypass-hidden-api-restrictions-via-jni-on-android [email protected]
- nursery/get-current-process-filesystem-mounts-on-linux [email protected]
- nursery/get-current-process-memory-mapping-on-linux [email protected]
- nursery/get-system-property-on-android [email protected]
- nursery/hook-routines-via-lsplant [email protected]
- nursery/load-packed-dex-via-jiagu-on-android [email protected]
- nursery/modify-api-blacklist-or-denylist-via-jni-on-android [email protected]
- nursery/truncate-file-on-linux [email protected]
Bug Fixes
- do some imports closer to where they are used #1810 @williballenthin
- binja: fix and simplify stack string detection code after binja 4.0 @xusheng6
- binja: add support for forwarded export #1646 @xusheng6
- cape: support more report formats #2035 @mr-tz
capa explorer IDA Pro plugin
Development
- ci: Fix PR review in the changelog check GH action #2004 @Ana06
- ci: use rules number badge stored in our bot gist and generated using
schneegans/dynamic-badges-action#2001 capa-rules#882 @Ana06 - ci: update github workflows to use latest version of actions that were using a deprecated version of node #1967 #2003 capa-rules#883 @sjha2048 @Ana06
- ci: update binja version to stable 4.0 #2016 @xusheng6
- ci: update github workflows to reflect the latest ghidrathon installation and bumped up jep, ghidra versions #2020 @psahithireddy
- ci: include rule caching in PyInstaller build process #2097 @s-ff
- add deptry support #1497 @s-ff
Raw diffs
Contributors
Assets 6
v7.0.1
This release fixes a circular import error when using capa as a library.
Bug Fixes
- fix potentially circular import errors #1969 @williballenthin
Raw diffs
Contributors
Assets 6
v7.0.0
This is the v7.0.0 release of capa which was mainly worked on during the Google Summer of Code (GSoC) 2023. A huge
shoutout to our GSoC contributors @colton-gabertan and @yelhamer for their amazing work. See our blog posts for more details:
Also, a big thanks to the other contributors: @aaronatp, @Aayush-Goel-04, @bkojusner, @doomedraven, @ruppde, @larchchen, @JCoonradt, and @xusheng6.
New Features
- add Ghidra backend #1770 #1767 @colton-gabertan @mike-hunhoff
- add Ghidra UI integration #1734 @colton-gabertan @mike-hunhoff
- add dynamic analysis via CAPE sandbox reports #48 #1535 @yelhamer
- binja: add support for forwarded exports #1646 @xusheng6
- binja: add support for symtab names #1504 @xusheng6
- add com class/interface features #322 @Aayush-Goel-04
- dotnet: emit enclosing class information for nested classes #1780 #1913 @bkojusner @mike-hunhoff
Breaking Changes
- remove the
SCOPE_*constants in favor of theScopeenum #1764 @williballenthin - protobuf: deprecate
RuleMetadata.scopein favor ofRuleMetadata.scopes@williballenthin - protobuf: deprecate
Metadata.analysisin favor ofMetadata.analysis2that is dynamic analysis aware @williballenthin - update freeze format to v3, adding support for dynamic analysis @williballenthin
- extractor: ignore DLL name for api features #1815 @mr-tz
- main: introduce wrapping routines within main for working with CLI args #1813 @williballenthin
- move functions from
capa.mainto newcapa.loadernamespace #1821 @williballenthin - proto: add
packagedeclaration #1960 @larchchen
New Rules (41)
- nursery/get-ntoskrnl-base-address @mr-tz
- host-interaction/network/connectivity/set-tcp-connection-state @johnk3r
- nursery/capture-process-snapshot-data @mr-tz
- collection/network/capture-packets-using-sharppcap [email protected]
- nursery/communicate-with-kernel-module-via-netlink-socket-on-linux [email protected]
- nursery/get-current-pid-on-linux [email protected]
- nursery/get-file-system-information-on-linux [email protected]
- nursery/get-password-database-entry-on-linux [email protected]
- nursery/mark-thread-detached-on-linux [email protected]
- nursery/persist-via-gnome-autostart-on-linux [email protected]
- nursery/set-thread-name-on-linux [email protected]
- load-code/dotnet/load-windows-common-language-runtime [email protected] [email protected] [email protected]
- nursery/log-keystrokes-via-input-method-manager @mr-tz
- nursery/encrypt-data-using-rc4-via-systemfunction032 [email protected]
- nursery/add-value-to-global-atom-table @mr-tz
- nursery/enumerate-processes-that-use-resource @Ana06
- host-interaction/process/inject/allocate-or-change-rwx-memory @mr-tz
- lib/allocate-or-change-rw-memory [email protected] @mr-tz
- lib/change-memory-protection @mr-tz
- anti-analysis/anti-av/patch-antimalware-scan-interface-function [email protected]
- executable/dotnet-singlefile/bundled-with-dotnet-single-file-deployment [email protected]
- internal/limitation/file/internal-dotnet-single-file-deployment-limitation [email protected]
- data-manipulation/encoding/encode-data-using-add-xor-sub-operations [email protected]
- nursery/access-camera-in-dotnet-on-android [email protected]
- nursery/capture-microphone-audio-in-dotnet-on-android [email protected]
- nursery/capture-screenshot-in-dotnet-on-android [email protected]
- nursery/check-for-incoming-call-in-dotnet-on-android [email protected]
- nursery/check-for-outgoing-call-in-dotnet-on-android [email protected]
- nursery/compiled-with-xamarin [email protected]
- nursery/get-os-version-in-dotnet-on-android [email protected]
- data-manipulation/compression/create-cabinet-on-windows [email protected] [email protected]
- data-manipulation/compression/extract-cabinet-on-windows [email protected]
- lib/create-file-decompression-interface-context-on-windows [email protected]
- nursery/enumerate-files-in-dotnet [email protected] [email protected]
- nursery/get-mac-address-in-dotnet [email protected] [email protected] [email protected]
- nursery/get-current-process-command-line [email protected]
- nursery/get-current-process-file-path [email protected]
- nursery/hook-routines-via-dlsym-rtld_next [email protected]
- nursery/linked-against-hp-socket [email protected]
- host-interaction/process/inject/process-ghostly-hollowing [email protected]
Bug Fixes
- ghidra: fix
ints_to_bytesperformance #1761 @mike-hunhoff - binja: improve function call site detection @xusheng6
- binja: use
binaryninja.loadto open files @xusheng6 - binja: bump binja version to 3.5 #1789 @xusheng6
- elf: better detect ELF OS via GCC .ident directives #1928 @williballenthin
- elf: better detect ELF OS via Android dependencies #1947 @williballenthin
- fix setuptools package discovery #1886 @gmacon @mr-tz
- remove unnecessary scripts/vivisect-py2-vs-py3.sh file #1949 @JCoonradt
capa explorer IDA Pro plugin
- various integration updates and minor bug fixes
Development
Developer Notes
With this new release, many classes and concepts have been split up into static (mostly identical to the
prior implementations) and dynamic ones. For example, the legacy FeatureExtractor class has been renamed to
StaticFeatureExtractor and the DynamicFeatureExtractor has been added.
Starting from version 7.0, we have moved the component responsible for feature extractor from main to a new
capabilities' module. Now, users wishing to utilize capa’s feature extraction abilities should use that module instead
of importing the relevant logic from the main file.
For sandbox-based feature extractors, we are using Pydantic models. Contributions of more models for other sandboxes
are very welcome!
With this release we've reorganized the logic found in main() to localize logic and ease readability and ease changes
and integrations. The new "main routines" are expected to be used only within main functions, either capa main or
related scripts. These functions should not be invoked from library code.
Beyond copying code around, we've refined the handling of the input file/format/backend. The logic for picking the
format and backend is more consistent. We've documented that the input file is not necessarily the sample itself
(cape/freeze/etc.) inputs are not actually the sample.
Raw diffs
Contributors
Assets 6
v7.0.0-beta
This is the beta release of capa v7.0 which was mainly worked on during the Google Summer of Code (GSoC) 2023. A huge
shoutout to @colton-gabertan and @yelhamer for their amazing work.
Also a big thanks to the other contributors: @aaronatp, @Aayush-Goel-04, @bkojusner, @doomedraven, @ruppde, and @xusheng6.
New Features
- add Ghidra backend #1770 #1767 @colton-gabertan @mike-hunhoff
- add dynamic analysis via CAPE sandbox reports #48 #1535 @yelhamer
- binja: add support for forwarded exports #1646 @xusheng6
- binja: add support for symtab names #1504 @xusheng6
- add com class/interface features #322 @Aayush-Goel-04
- dotnet: emit enclosing class information for nested classes #1780 #1913 @bkojusner @mike-hunhoff
Breaking Changes
- remove the
SCOPE_*constants in favor of theScopeenum #1764 @williballenthin - protobuf: deprecate
RuleMetadata.scopein favor ofRuleMetadata.scopes@williballenthin - protobuf: deprecate
Metadata.analysisin favor ofMetadata.analysis2that is dynamic analysis aware @williballenthin - update freeze format to v3, adding support for dynamic analysis @williballenthin
- extractor: ignore DLL name for api features #1815 @mr-tz
New Rules (41)
- nursery/get-ntoskrnl-base-address @mr-tz
- host-interaction/network/connectivity/set-tcp-connection-state @johnk3r
- nursery/capture-process-snapshot-data @mr-tz
- collection/network/capture-packets-using-sharppcap [email protected]
- nursery/communicate-with-kernel-module-via-netlink-socket-on-linux [email protected]
- nursery/get-current-pid-on-linux [email protected]
- nursery/get-file-system-information-on-linux [email protected]
- nursery/get-password-database-entry-on-linux [email protected]
- nursery/mark-thread-detached-on-linux [email protected]
- nursery/persist-via-gnome-autostart-on-linux [email protected]
- nursery/set-thread-name-on-linux [email protected]
- load-code/dotnet/load-windows-common-language-runtime [email protected] [email protected] [email protected]
- nursery/log-keystrokes-via-input-method-manager @mr-tz
- nursery/encrypt-data-using-rc4-via-systemfunction032 [email protected]
- nursery/add-value-to-global-atom-table @mr-tz
- nursery/enumerate-processes-that-use-resource @Ana06
- host-interaction/process/inject/allocate-or-change-rwx-memory @mr-tz
- lib/allocate-or-change-rw-memory [email protected] @mr-tz
- lib/change-memory-protection @mr-tz
- anti-analysis/anti-av/patch-antimalware-scan-interface-function [email protected]
- executable/dotnet-singlefile/bundled-with-dotnet-single-file-deployment [email protected]
- internal/limitation/file/internal-dotnet-single-file-deployment-limitation [email protected]
- data-manipulation/encoding/encode-data-using-add-xor-sub-operations [email protected]
- nursery/access-camera-in-dotnet-on-android [email protected]
- nursery/capture-microphone-audio-in-dotnet-on-android [email protected]
- nursery/capture-screenshot-in-dotnet-on-android [email protected]
- nursery/check-for-incoming-call-in-dotnet-on-android [email protected]
- nursery/check-for-outgoing-call-in-dotnet-on-android [email protected]
- nursery/compiled-with-xamarin [email protected]
- nursery/get-os-version-in-dotnet-on-android [email protected]
- data-manipulation/compression/create-cabinet-on-windows [email protected] [email protected]
- data-manipulation/compression/extract-cabinet-on-windows [email protected]
- lib/create-file-decompression-interface-context-on-windows [email protected]
- nursery/enumerate-files-in-dotnet [email protected] [email protected]
- nursery/get-mac-address-in-dotnet [email protected] [email protected] [email protected]
- nursery/get-current-process-command-line [email protected]
- nursery/get-current-process-file-path [email protected]
- nursery/hook-routines-via-dlsym-rtld_next [email protected]
- nursery/linked-against-hp-socket [email protected]
- host-interaction/process/inject/process-ghostly-hollowing [email protected]
Bug Fixes
- ghidra: fix
ints_to_bytesperformance #1761 @mike-hunhoff - binja: improve function call site detection @xusheng6
- binja: use
binaryninja.loadto open files @xusheng6 - binja: bump binja version to 3.5 #1789 @xusheng6
- elf: better detect ELF OS via GCC .ident directives #1928 @williballenthin
- fix setuptools package discovery #1886 @gmacon @mr-tz
Development
Developer Notes
With this new release, many classes and concepts have been split up into static (mostly identical to the
prior implementations) and dynamic ones. For example, the legacy FeatureExtractor class has been renamed to
StaticFeatureExtractor and the DynamicFeatureExtractor has been added.
Starting from version 7.0, we have moved the component responsible for feature extractor from main to a new
capabilities' module. Now, users wishing to utilize capa’s feature extraction abilities should use that module instead
of importing the relevant logic from the main file.
For sandbox-based feature extractors, we are using Pydantic models. Contributions of more models for other sandboxes
are very welcome!
Raw diffs
Contributors
Assets 6
v6.1.0
capa v6.1.0 is a bug fix release, most notably fixing unhandled exceptions in the capa explorer IDA Pro plugin. @Aayush-Goel-04 put a lot of effort into improving code quality and adding a script for rule authors. The script shows which features are present in a sample but not referenced by any existing rule. You could use this script to find opportunities for new rules.
Speaking of new rules, we have eight additions, coming from Ronnie, Jakub, Moritz, Ervin, and [email protected]!
New Features
- ELF: implement import and export name extractor #1607 #1608 @Aayush-Goel-04
- bump pydantic from 1.10.9 to 2.1.1 #1582 @Aayush-Goel-04
- develop script to highlight features not used during matching #331 @Aayush-Goel-04
New Rules (8)
- executable/pe/export/forwarded-export [email protected]
- host-interaction/bootloader/get-uefi-variable [email protected]
- host-interaction/bootloader/set-uefi-variable [email protected]
- nursery/enumerate-device-drivers-on-linux @mr-tz
- anti-analysis/anti-vm/vm-detection/check-for-foreground-window-switch [email protected]
- linking/static/sqlite3/linked-against-cppsqlite3 [email protected]
- linking/static/sqlite3/linked-against-sqlite3 [email protected]
Modified rules (9)
- anti-analysis/anti-forensic/self-deletion/self-delete.yml
- collection/browser/gather-chrome-based-browser-login-information.yml
- collection/browser/gather-firefox-profile-information.yml
- data-manipulation/encoding/base64/decode-data-using-base64-via-dword-translation-table.yml
- host-interaction/process/inject/free-user-process-memory.yml
- lib/get-os-version.yml
- nursery/deserialize-json-in-dotnet.yml
- nursery/serialize-json-in-dotnet.yml
- persistence/authentication-process/act-as-credential-manager-dll.yml
Renamed rules (1)
Bug Fixes
- rules: fix forwarded export characteristic #1656 @RonnieSalomonsen
- Binary Ninja: Fix stack string detection #1473 @xusheng6
- linter: skip native API check for NtProtectVirtualMemory #1675 @williballenthin
- OS: detect Android ELF files #1705 @williballenthin
- ELF: fix parsing of symtab #1704 @williballenthin
- result document: don't use deprecated pydantic functions #1718 @williballenthin
- pytest: don't mark IDA tests as pytest tests #1719 @williballenthin
capa explorer IDA Pro plugin
- fix unhandled exception when resolving rule path #1693 @mike-hunhoff
EDIT: a standalone binary created using Python 3.11 is now available.
