mandiant/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2026-10-12 02:18:37 +00:00
Code Issues Packages Projects Releases Wiki Activity
6,286 Commits 65 Branches 49 Tags
feature/script-analysis
Commit Graph
352 Commits
Author SHA1 Message Date
Saniya FatimaEdoardo AllegriniAdam Storek
 		a401849141 Add support for script analysis (#3102) 
Adds static analysis for script files (C#, Python, ASPX, HTML embedded scripts)
using Tree-Sitter feature extractors.

Revives and completes work originally introduced in #1080.

Co-authored-by: Edoardo Allegrini <[email protected]>
Co-authored-by: Adam Storek <[email protected]>
 2026-08-18 14:51:58 +00:00
Mike Hunhoff 1d02bcb94b ci: trigger workflows for feature/script-analysis branch (#3142) 2026-08-18 14:51:58 +00:00
Willi Ballenthin b505ba7621 fix: remove unused imports and un-suppress F401 
closes #2996
 2026-05-08 17:58:07 +02:00
Moritz 99ecd65852 ci: update GitHub Actions to Node.js 24 (#2984) 
* ci: update GitHub Actions to Node.js 24 and pin more versions
 2026-04-13 16:35:55 +02:00
Mike Hunhoff 0798528b7b ci: use explicit and per job permissions (#3002) 
* ci: use explicit and per job permissions

* update CHANGELOG
 2026-04-07 14:39:41 -06:00
Mike Hunhoff c55b06860c ci: fix web rules failure (#3003) 
* ci: fix web rules failure

* address feedback

* ruff cleanup
 2026-04-07 13:01:23 -06:00
Mike Hunhoff ed7e0cd77d lint: replace black/isort/flake8 with ruff (#2992) 
* lint: replace isort/flake8 with ruff

* update ruff links

* remove stale isort reference

* update CHANGELOG

* address review

* remove unused imports

* remove unnecessary list comprehension

* remove quotes from type annotation

* use dict.get instead of if-else block

* remove unnecessary utf-8 encoding declaration

* Revert "remove unused imports"

This reverts commit 18ba50a22b.

* skip check for unused imports

* fix UP036 Version block is outdated for minimum Python version

* add TODO comment for unused imports

* replace black with ruff

* address review comments
 2026-04-07 12:10:41 -06:00
Rizky Mirzaviandy PriambodoandMike Hunhoff ac82a25e11 build: bump linux standalone build to Python 3.13 (#2941) 
Co-authored-by: Mike Hunhoff <[email protected]>
 2026-04-03 09:42:00 -06:00
mr-tz 4e4e16391a ci: fix ZIP_NAME environment variable in build workflow 2026-04-01 09:27:00 +00:00
dependabot[bot]MoritzCapa Bot
 		7b23834d8e build(deps-dev): bump black from 25.12.0 to 26.3.0 (#2902) 
* build(deps-dev): bump black from 25.12.0 to 26.3.0

Bumps [black](https://github.com/psf/black) from 25.12.0 to 26.3.0.
- [Release notes](https://github.com/psf/black/releases)
- [Changelog](https://github.com/psf/black/blob/main/CHANGES.md)
- [Commits](https://github.com/psf/black/compare/25.12.0...26.3.0)

---
updated-dependencies:
- dependency-name: black
  dependency-version: 26.3.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

* style: auto-format with black and isort

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Moritz <[email protected]>
Co-authored-by: Capa Bot <[email protected]>
 2026-03-13 15:46:13 +01:00
Priyank Patel e53f6abc1e ci: add black auto-format workflow (#2827) (#2883) 
* ci: add black auto-format workflow (#2827)

Signed-off-by: priyank <[email protected]>

* ci: use pre-commit to run black and isort (#2827)

* ci: fix install dependencies to include dev extras

---------

Signed-off-by: priyank <[email protected]>
 2026-03-05 12:29:33 +01:00
kamran ul haq da1abed3f8 ci: pin pip-audit action SHAs and update to v1.1.0 (#2884) 
* Fix conftest imports to use relative imports

After adding tests/__init__.py, conftest.py needs relative imports

* ci: pin pip-audit action SHAs and update to v1.1.0

* revert: remove unrelated conftest.py changes
 2026-02-27 17:36:28 +01:00
kamran ul haq 10dfd287b4 ci: cache vivisect workspaces between CI runs to speed up tests (#2881) 2026-02-25 23:15:13 +01:00
Devyansh Somvanshi e9b3311338 binja: add mypy config for top-level binaryninja module (#2877) 
Allow mypy to skip missing 'binaryninja' (not just binaryninja.*)
when the Binary Ninja API is not installed.

Fixes #2399
 2026-02-24 08:57:46 -07:00
Ben Knutson f7bb889f30 Refactor Github Action per b/485167538 2026-02-18 16:51:42 +00:00
dependabot[bot]andMike Hunhoff 1500a34984 build(deps): bump rich from 14.2.0 to 14.3.2 (#2849) 
* build(deps): bump rich from 14.2.0 to 14.3.2

Bumps [rich](https://github.com/Textualize/rich) from 14.2.0 to 14.3.2.
- [Release notes](https://github.com/Textualize/rich/releases)
- [Changelog](https://github.com/Textualize/rich/blob/master/CHANGELOG.md)
- [Commits](https://github.com/Textualize/rich/compare/v14.2.0...v14.3.2)

---
updated-dependencies:
- dependency-name: rich
  dependency-version: 14.3.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>

* add hiddenimports for rich module

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Mike Hunhoff <[email protected]>
 2026-02-05 09:31:15 -07:00
Moritzgemini-code-assist[bot]Mike Hunhoff
 		ff8e7ef52f Add AI usage checkbox (#2844) 
* Add AI usage checkbox

* Apply suggestion from @gemini-code-assist[bot]

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

---------

Co-authored-by: Mike Hunhoff <[email protected]>
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
 2026-01-29 09:12:54 -07:00
Daniel Adeboye 37f2a897ff tests: remove redundant test_ida_features.py (#2834) 2026-01-23 09:46:58 -07:00
Maijin e39e610f66 Create a vivisect group in dependabot.yml (#2830) 
* Add msgpack group in dependabot.yml

Add msgpack group in dependabot.yml

* Change to make a vivisect group

Change to make a vivisect group

* Update dependabot.yml
 2026-01-23 09:37:04 -07:00
Maijin 203cc0aa0c Merge pull request #2824 from Maijin/patch-1 
Group pyasn modules and vivisect in dependabot.yml
 2026-01-20 10:18:35 +01:00
Willi Ballenthin c89871f257 ci: pin setup-uv 2026-01-13 16:15:31 +01:00
Willi Ballenthin f72bd49a5f ci: enable testing of IDA 9.0 2026-01-13 16:15:31 +01:00
Willi Ballenthin c5808c4c41 tests: idalib: use 9.1 instead of 9.0 as min ver 
9.0 doesn't support disabling lumina (or loading resources, for that
matter, too)
 2026-01-13 16:15:31 +01:00
mr-tz 4fb6ac0d1b add ida version to test matrix name 2026-01-13 16:15:31 +01:00
Willi Ballenthin 9c6db00775 ci: add configuration for idalib tests 2026-01-13 16:15:31 +01:00
Mike Hunhoffandgemini-code-assist[bot] 66dc70a775 ghidra: support PyGhidra (#2788) 
* ghidra: init commit switch to PyGhidra

* update CHANGELOG and PyGhidra version requirements

* Update capa/features/extractors/ghidra/helpers.py

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

* fix black errors

* support Ghidra v12

* remove deprecated APIs

* refactor outdated code

* fix pyinstaller, code refactoring

* address PR feedback

* add back capa_explorer.py

* beef up capa_explorer.py script

* refactor README

* refactor README

* fix #2747

* add sha256 check for workflows

* add sha256 check for workflows

* add sha256 check for workflows

---------

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
 2025-12-18 17:55:49 -07:00
Mike Hunhoff ffce77b13d ci: deprecate macos-13 runner and use Python v3.13 for testing (#2777) 2025-11-24 19:53:39 -07:00
Mike Hunhoff d6f442b5bd ci: remove redundant "test_run" action (#2692) 
* ci: remove redundant "test_run" action

* update CHANGELOG
 2025-06-10 16:43:10 -06:00
Spencer Heywood 0da5d7c5b5 add support for arm64 binary releases (#2691) 2025-06-10 15:52:55 -06:00
Mike Hunhoff 30fb4751f6 fix build issues discovered during and after v9.2.0 release (#2684) 
* ci: downgrade Ubuntu version to accommodate older GLIBC versions

* ci: upgrade Windows version to avoid deprecation

* ci: exclude pkg_resources from PyInstaller build

* update CHANGELOG

* update spec file

* ci: check if build runs without warnings or errors

* update CHANGELOG

* update build commands

* update build commands

* update build commands

* update build commands

* update build commands
 2025-06-06 12:02:06 -06:00
Mike Hunhoff a8eab7ddf0 update "publish package" worflow to 1.12.4 (#2680) 2025-06-05 13:44:30 -06:00
Ana María Martínez Gómez d1090e8391 ci: Update Ubuntu version in actions (#2656) 
ubuntu-20.04 has been deprecated causing several GH actions to fail:
https://github.com/actions/runner-images/issues/11101
 2025-05-09 15:40:59 -06:00
Ana Maria Martinez Gomez 3cd97ae9f2 [copyright + license] Fix headers 
Replace the header from source code files using the following script:
```Python
for dir_path, dir_names, file_names in os.walk("capa"):
    for file_name in file_names:
        # header are only in `.py` and `.toml` files
        if file_name[-3:] not in (".py", "oml"):
            continue
        file_path = f"{dir_path}/{file_name}"
        f = open(file_path, "rb+")
        content = f.read()
        m = re.search(OLD_HEADER, content)
        if not m:
            continue
        print(f"{file_path}: {m.group('year')}")
        content = content.replace(m.group(0), NEW_HEADER % m.group("year"))
        f.seek(0)
        f.write(content)
```

Some files had the copyright headers inside a `"""` comment and needed
manual changes before applying the script. `hook-vivisect.py` and
`pyinstaller.spec` didn't include the license in the header and also
needed manual changes.

The old header had the confusing sentence `All rights reserved`, which
does not make sense for an open source license. Replace the header by
the default Google header that corrects this issue and keep capa
consistent with other Google projects.

Adapt the linter to work with the new header.

Replace also the copyright text in the `web/public/index.html` file for
consistency.
 2025-01-15 08:52:42 -07:00
Ana Maria Martinez Gomez b4aa65daa1 [CONTRIBUTING] Use Google's Code of Conduct 
Use Google's default Code of Conduct for consistency with other Google's
projects.
 2025-01-15 08:52:42 -07:00
Ana Maria Martinez Gomez bf9753ef93 [CONTRIBUTING] Improve CLA information 
Improve CLA information to adhere to Google policies.
 2025-01-15 08:52:42 -07:00
farissandMoritz 02b5e11380 ci: pin Github Actions version in web-release.yml 
Co-authored-by: Moritz <[email protected]>
 2024-11-27 14:00:30 +01:00
Soufiane Fariss 32c428b989 ci: explorer web: modify web-release to open a PR 2024-11-26 19:49:10 +01:00
Moritz c632d594a6 Use macOS 13 (#2488) 
* update to macos-13
 2024-11-11 16:42:26 +01:00
Soufiane Fariss 24236dda0e ci: skip changelog.yml when PR author is dependabot 2024-10-23 00:05:52 +02:00
Fariss 7d8ee6aaac Merge pull request #2455 from s-ff/web-add-releases-workflow 2024-10-22 15:23:37 +02:00
mr-tz 20ae098cda update Python >= 3.10 and ubuntu 2024-10-22 09:38:32 +00:00
mr-tz cebf8e7274 update minimum Python to 3.10 2024-10-21 15:25:21 +00:00
Soufiane Fariss 54badc323d ci: add CHANGELOG.md for web releases 2024-10-14 12:55:56 +02:00
Soufiane Fariss ca7073ce87 ci: add web releases workflow 2024-10-09 18:07:48 +02:00
Moritz c7bb8b8e67 Update Node checkout Actions (#2446) 
* Update setup Node Actions
 2024-10-07 11:46:37 +02:00
Moritz f0cc0fb2b8 Update build.yml 2024-10-04 14:02:53 +02:00
Moritz e4ac02a968 Update dependabot.yml 2024-10-01 13:32:31 +02:00
Fariss 51a4eb46b8 replace tqdm, termcolor, tabulate with rich (#2374) 
* logging: use rich handler for logging

* tqdm: remove unneeded redirecting_print_to_tqdm function

* tqdm: introduce `CapaProgressBar` rich `Progress` bar

* tqdm: replace tqdm with rich Progress bar

* tqdm: remove tqdm dependency

* termcolor: replace termcolor and update `scripts/`

* tests: update `test_render.py` to use rich.console.Console

* termcolor: remove termcolor dependency

* capa.render.utils: add `write` & `writeln` methods to subclass `Console`

* update markup util functions to use fmt strings

* tests: update `test_render.py` to use `capa.render.utils.Console`

* replace kwarg `end=""` with `write` and `writeln` methods

* tabulate: replace tabulate with `rich.table`

* tabulate: remove `tabulate` and its dependency `wcwidth`

* logging: handle logging in `capa.main`

* logging: set up logging in `capa.main`

this commit sets up logging in `capa.main` and uses a shared
`log_console` in `capa.helpers` for logging purposes

* changelog: replace packages with rich

* remove entry from pyinstaller and unneeded progress.update call

* update requirements.txt

* scripts: use `capa.helpers.log_console` in `CapaProgressBar`

* logging: configure root logger to use `RichHandler`

* remove unused import `inspect`
 2024-09-27 09:34:21 +02:00
Willi Ballenthin bcd57a9af1 detect and use third-party analysis backends when possible (#2380) 
* introduce script to detect 3P backends

ref #2376

* add idalib backend

* binary ninja: search for API using XDG desktop entry

ref #2376

* binja: search more XDG locations for desktop entry

* binary ninja: optimize embedded PE scanning

closes #2397

* add script for comparing the performance of analysis backends
 2024-09-26 13:21:55 +02:00
Willi Ballenthin 783e14b949 pyinstaller: use Python 3.12 for standalone build (#2385) 
* pyinstaller: use Python 3.12 for standalone build

closes #2383

* changelog

* ci: build: fix test filename
 2024-09-23 22:33:23 +02:00