Manually deleting the .viv files seems to be required?

[recvfrom]

I wrote a small test program for use in testing out a capa rule, and by default it got compiled as a.exe... I noticed that after running capa on it the first time, it generates a file named a.exe.viv, and it looks like that file gets used for subsequent capa runs. If I make changes to the test program and recompile, I have to manually delete the a.exe.viv file for the changes to take effect. Is that the intended functionality? If not, I do see the following message when I run capa, so maybe that's related? capa seems to run fine despite this warning, though.

WARNING:viv_utils:vivisect version mismatch! wanted: 1.0.3, found: None

[williballenthin]

A .viv file is the cached workspace created by vivisect, rather like an .idb from IDA. by re-using the .viv file, subsequent runs of capa can avoid re-analyzing the binary, potentially allowing it to run faster.

1. is this behavior surprising?
2. do you re-run capa against the same samples often (would you see a benefit of caching the viv)?
3. should we not cache the .viv files?

[recvfrom]

Hmm, my guess is that most production use-cases of capa would infrequently analyze the same executable more than once, and the .viv file sticking around might be more harmful than helpful since additional logic would be needed to clean those up (and users might not realize that the .viv files are created and not removed, leading to disk space issues).

On the capa rule development side, having a speedier analysis is definitely beneficial, although ideally the .viv file would be regenerated behind the scenes if the file that it corresponds to has been modified (like how Python's caching of compiled code works). I think the primary use cases for running capa while iteratively changing an executable are the use case mentioned above (test case development) and also people modifying an executable for other reasons (like trying to modify existing code to evade capa rules, lol!). If the underlying executable is always changing between runs, though, then I suppose there's not a benefit from the .viv file caching for these use cases.

Maybe .viv file creation could be optional + disabled by default, and people that do analyze the same files repeatedly without file modifications could enable it?

[mr-tz]

side note WARNING:viv_utils:vivisect version mismatch! wanted: 1.0.3, found: None should be fixed after the viv-utils dependency update

[williballenthin]

#640 disables the creation of viv files by default