vee1e/capa
1
0
Fork 0
mirror of https://github.com/vee1e/capa.git synced 2026-09-01 18:57:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Update capa2yara.py (#1904)

Browse source 
Extend unhandled strings to allow capa2yara to run through
This commit is contained in:
Arnim Rupp 2023-12-13 15:51:56 +01:00 • committed by GitHub
parent f229c8ecb8
commit 1d3ae1f216
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
scripts/capa2yara.py
View file

@ -61,7 +61,7 @@ var_names = ["".join(letters) for letters in itertools.product(string.ascii_lowe
# this have to be the internal names used by capa.py which are sometimes different to the ones written out in the rules, e.g. "2 or more" is "Some", count is Range
unsupported = ["characteristic", "mnemonic", "offset", "subscope", "Range"]
unsupported = ["characteristic", "mnemonic", "offset", "subscope", "Range", "os", "property", "format", "class", "operand[0].number", "operand[1].number", "substring", "arch", "namespace"]
# further idea: shorten this list, possible stuff:
# - 2 or more strings: e.g.
# -- https://github.com/mandiant/capa-rules/blob/master/collection/file-managers/gather-direct-ftp-information.yml
@ -90,8 +90,7 @@ condition_header = """
condition_rule = """
private rule capa_pe_file : CAPA {
meta:
description = "match in PE files. used by all further CAPA rules"
author = "Arnim Rupp"
description = "Match in PE files. Used by other CAPA rules"
condition:
uint16be(0) == 0x4d5a
or uint16be(0) == 0x558b