def find_function_capabilities(ruleset: RuleSet, extractor: FeatureExtractor, f: FunctionHandle): # contains features from: # - insns # - function function_features = collections.defaultdict(set) # type: FeatureSet bb_matches = collections.defaultdict(list) # type: MatchResults for feature, va in itertools.chain(extractor.extract_function_features(f), extractor.extract_global_features()): function_features[feature].add(va) for bb in extractor.get_basic_blocks(f): # contains features from: # - insns # - basic blocks bb_features = collections.defaultdict(set) for feature, va in itertools.chain( extractor.extract_basic_block_features(f, bb), extractor.extract_global_features()): bb_features[feature].add(va) function_features[feature].add(va) for insn in extractor.get_instructions(f, bb): for feature, va in itertools.chain( extractor.extract_insn_features(f, bb, insn), extractor.extract_global_features()): bb_features[feature].add(va) function_features[feature].add(va) _, matches = ruleset.match(Scope.BASIC_BLOCK, bb_features, int(bb)) for rule_name, res in matches.items(): bb_matches[rule_name].extend(res) rule = ruleset[rule_name] for va, _ in res: capa.engine.index_rule_matches(function_features, rule, [va]) _, function_matches = ruleset.match(Scope.FUNCTION, function_features, int(f)) return function_matches, bb_matches, len(function_features)
def find_function_capabilities(ruleset: RuleSet, extractor: FeatureExtractor, f: FunctionHandle): # contains features from: # - insns # - function function_features = collections.defaultdict(set) # type: FeatureSet bb_matches = collections.defaultdict(list) # type: MatchResults for feature, va in extractor.extract_function_features(f): function_features[feature].add(va) for bb in extractor.get_basic_blocks(f): # contains features from: # - insns # - basic blocks bb_features = collections.defaultdict(set) for feature, va in extractor.extract_basic_block_features(f, bb): bb_features[feature].add(va) function_features[feature].add(va) for insn in extractor.get_instructions(f, bb): for feature, va in extractor.extract_insn_features(f, bb, insn): bb_features[feature].add(va) function_features[feature].add(va) _, matches = capa.engine.match(ruleset.basic_block_rules, bb_features, int(bb)) for rule_name, res in matches.items(): bb_matches[rule_name].extend(res) for va, _ in res: function_features[capa.features.common.MatchedRule( rule_name)].add(va) _, function_matches = capa.engine.match(ruleset.function_rules, function_features, int(f)) return function_matches, bb_matches, len(function_features)
def find_code_capabilities( ruleset: RuleSet, extractor: FeatureExtractor, f: FunctionHandle ) -> Tuple[MatchResults, MatchResults, MatchResults, int]: """ find matches for the given rules within the given function. returns: tuple containing (match results for function, match results for basic blocks, match results for instructions, number of features) """ # all features found within this function, # includes features found within basic blocks (and instructions). function_features = collections.defaultdict(set) # type: FeatureSet # matches found at the basic block scope. # might be found at different basic blocks, thats ok. bb_matches = collections.defaultdict(list) # type: MatchResults # matches found at the instruction scope. # might be found at different instructions, thats ok. insn_matches = collections.defaultdict(list) # type: MatchResults for bb in extractor.get_basic_blocks(f): features, bmatches, imatches = find_basic_block_capabilities(ruleset, extractor, f, bb) for feature, vas in features.items(): function_features[feature].update(vas) for rule_name, res in bmatches.items(): bb_matches[rule_name].extend(res) for rule_name, res in imatches.items(): insn_matches[rule_name].extend(res) for feature, va in itertools.chain(extractor.extract_function_features(f), extractor.extract_global_features()): function_features[feature].add(va) _, function_matches = ruleset.match(Scope.FUNCTION, function_features, int(f)) return function_matches, bb_matches, insn_matches, len(function_features)