diff --git a/capa/features/extractors/cape/extractor.py b/capa/features/extractors/cape/extractor.py index 02fa90883e..1c8cfd2a0c 100644 --- a/capa/features/extractors/cape/extractor.py +++ b/capa/features/extractors/cape/extractor.py @@ -85,6 +85,7 @@ def from_report(cls, report: Dict) -> "CapeExtractor": if cr.info.version not in TESTED_VERSIONS: logger.warning("CAPE version '%s' not tested/supported yet", cr.info.version) + # observed in 2.4-CAPE reports from capesandbox.com if cr.static is None and cr.target.file.pe is not None: cr.static = Static() cr.static.pe = cr.target.file.pe diff --git a/capa/features/extractors/cape/models.py b/capa/features/extractors/cape/models.py index 22e5f15e0c..870afa820a 100644 --- a/capa/features/extractors/cape/models.py +++ b/capa/features/extractors/cape/models.py @@ -205,11 +205,9 @@ class PE(ExactModel): guest_signers: Signer -# TODO -# target.file.dotnet, -# target.file.extracted_files, -# target.file.extracted_files_tool, +# TODO(mr-tz): target.file.dotnet, target.file.extracted_files, target.file.extracted_files_tool, # target.file.extracted_files_time +# https://github.com/mandiant/capa/issues/1814 class File(FlexibleModel): type: str cape_type_code: Optional[int] = None diff --git a/capa/helpers.py b/capa/helpers.py index 9219f5899e..ee7bbca377 100644 --- a/capa/helpers.py +++ b/capa/helpers.py @@ -150,7 +150,7 @@ def log_unsupported_format_error(): def log_unsupported_cape_report_error(error: str): logger.error("-" * 80) - logger.error(f" Input file is not a valid CAPE report: {error}") + logger.error("Input file is not a valid CAPE report: %s", error) logger.error(" ") logger.error(" capa currently only supports analyzing standard CAPE json reports.") logger.error( @@ -161,7 +161,7 @@ def log_unsupported_cape_report_error(error: str): def log_empty_cape_report_error(error: str): logger.error("-" * 80) - logger.error(f" CAPE report is empty or only contains little useful data: {error}") + logger.error(" CAPE report is empty or only contains little useful data: %s", error) logger.error(" ") logger.error(" Please make sure the sandbox run captures useful behaviour of your sample.") logger.error("-" * 80) diff --git a/capa/main.py b/capa/main.py index d458b4e1f6..afc5ab5deb 100644 --- a/capa/main.py +++ b/capa/main.py @@ -906,9 +906,10 @@ def get_rules( # rule_file_paths[i] corresponds to rule_contents[i]. rule_contents = [file_path.read_bytes() for file_path in rule_file_paths] - ruleset = capa.rules.cache.load_cached_ruleset(cache_dir, rule_contents) - if ruleset is not None: - return ruleset + # TODO enable cache once fixes + # ruleset = capa.rules.cache.load_cached_ruleset(cache_dir, rule_contents) + # if ruleset is not None: + # return ruleset rules: List[Rule] = [] @@ -1573,8 +1574,9 @@ def main(argv: Optional[List[str]] = None): should_save_workspace = os.environ.get("CAPA_SAVE_WORKSPACE") not in ("0", "no", "NO", "n", None) - # TODO this should be wrapped and refactored as it's tedious to update everywhere + # TODO(mr-tz): this should be wrapped and refactored as it's tedious to update everywhere # see same code and show-features above examples + # https://github.com/mandiant/capa/issues/1813 try: extractor = get_extractor( args.sample,