From eb2ac6275797923b1e049c3eec6b9f0a9664f2d7 Mon Sep 17 00:00:00 2001 From: mr-tz Date: Tue, 17 Oct 2023 17:16:10 +0200 Subject: [PATCH] address comments from code review --- capa/features/extractors/cape/extractor.py | 1 + capa/helpers.py | 4 ++-- capa/main.py | 3 ++- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/capa/features/extractors/cape/extractor.py b/capa/features/extractors/cape/extractor.py index 02fa90883e..1c8cfd2a0c 100644 --- a/capa/features/extractors/cape/extractor.py +++ b/capa/features/extractors/cape/extractor.py @@ -85,6 +85,7 @@ def from_report(cls, report: Dict) -> "CapeExtractor": if cr.info.version not in TESTED_VERSIONS: logger.warning("CAPE version '%s' not tested/supported yet", cr.info.version) + # observed in 2.4-CAPE reports from capesandbox.com if cr.static is None and cr.target.file.pe is not None: cr.static = Static() cr.static.pe = cr.target.file.pe diff --git a/capa/helpers.py b/capa/helpers.py index 9219f5899e..ee7bbca377 100644 --- a/capa/helpers.py +++ b/capa/helpers.py @@ -150,7 +150,7 @@ def log_unsupported_format_error(): def log_unsupported_cape_report_error(error: str): logger.error("-" * 80) - logger.error(f" Input file is not a valid CAPE report: {error}") + logger.error("Input file is not a valid CAPE report: %s", error) logger.error(" ") logger.error(" capa currently only supports analyzing standard CAPE json reports.") logger.error( @@ -161,7 +161,7 @@ def log_unsupported_cape_report_error(error: str): def log_empty_cape_report_error(error: str): logger.error("-" * 80) - logger.error(f" CAPE report is empty or only contains little useful data: {error}") + logger.error(" CAPE report is empty or only contains little useful data: %s", error) logger.error(" ") logger.error(" Please make sure the sandbox run captures useful behaviour of your sample.") logger.error("-" * 80) diff --git a/capa/main.py b/capa/main.py index d458b4e1f6..c53e8e94d3 100644 --- a/capa/main.py +++ b/capa/main.py @@ -1573,8 +1573,9 @@ def main(argv: Optional[List[str]] = None): should_save_workspace = os.environ.get("CAPA_SAVE_WORKSPACE") not in ("0", "no", "NO", "n", None) - # TODO this should be wrapped and refactored as it's tedious to update everywhere + # TODO(mr-tz) this should be wrapped and refactored as it's tedious to update everywhere # see same code and show-features above examples + # https://github.com/mandiant/capa/issues/1813 try: extractor = get_extractor( args.sample,