Skip to content

Releases: mandiant/capa

v8.0.1

09 Dec 17:12
@mr-tz mr-tz
v8.0.1
1a82b9d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v8.0.1 Latest
Latest

This point release fixes an issue with the IDAPython API to now handle IDA Pro 8.3, 8.4, and 9.0 correctly.

Bug Fixes

  • handle IDA 8.3/8.4 vs. 9.0 API change @mr-tz

Raw diffs

Contributors

mr-tz
Assets 6
Loading

v8.0.0

09 Dec 13:17
@mr-tz mr-tz
v8.0.0
f11661f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v8.0.0

capa version 8 adds support for IDA Pro 9.0 (and idalib). The release comes with various improvements and bug fixes for the Binary Ninja backend (including to load with database files) -- thanks to @xusheng6.

Additional bug fixes improve the dynamic and BinExport backends.

capa version 8 now requires Python 3.10 or newer.

Special thanks to @Tamir-K, @harshit-wadhwani, @jorik-utwente for their great contributions.

New Features

  • allow call as valid subscope for call scoped rules @mr-tz
  • support loading and analyzing a Binary Ninja database #2496 @xusheng6
  • vmray: record process command line details @mr-tz

Breaking Changes

  • remove support for Python 3.8 and use Python 3.10 as minimum now #1966 @mr-tz

New Rules (54)

Bug Fixes

  • extractor: fix exception when PE extractor encounters unknown architecture #2440 @Tamir-K
  • IDA Pro: rename ida to idapro module for plugin and idalib in IDA 9.0 #2453 @mr-tz
  • ghidra: fix saving of base address @mr-tz
  • binja: support loading raw x86/x86_64 shellcode #2489 @xusheng6
  • binja: fix crash when the IL of certain functions are not available. #2249 @xusheng6
  • binja: major performance improvement on the binja extractor. #1414 @xusheng6
  • cape: make Process model flexible and procmemory optional to load newest reports #2466 @mr-tz
  • binja: fix unit test failure by fixing up the analysis for file al-khaser_x64.exe_ #2507 @xusheng6
  • binja: move the stack string detection to function level #2516 @xusheng6
  • BinExport2: fix handling of incorrect thunk functions #2524 @williballenthin
  • BinExport2: more precise pruning of expressions @williballenthin
  • BinExport2: better handle weird expression trees from Ghidra #2528 #2530 @williballenthin

capa Explorer Web

capa Explorer IDA Pro plugin

  • fix bug preventing saving of capa results via Save button @mr-tz
  • fix saving of base address @mr-tz

Development

  • CI: use macos-13 since macos-12 is deprecated and will be removed on December 3rd, 2024 #2173 @mr-tz
  • CI: update Binary Ninja version to 4.2 #2499 @xusheng6

Raw diffs

Contributors

williballenthin, mr-tz, and 4 other contributors
Assets 6
Loading

v7.4.0

04 Oct 11:53
@mr-tz mr-tz
v7.4.0
fc8089c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v7.4.0

The v7.4.0 capa release fixes a bug when processing VMRay analysis archives and enhances API extraction for all dynamic backends. For better terminal rendering capa now solely relies on the rich library.

The standalone capa executable can now automatically detect installations of relevant third party applications and use their backends (notably, idalib and Binary Ninja). For the extra standalone Linux build we've upgraded from Python 3.11 to 3.12.

Twelve new rules have been added. Thanks to all the contributors!

This is the last capa version supporting Python 3.8 and 3.9. If you have major concerns about this please reach out to us.

New Features

New Rules (15)

Bug Fixes

capa Explorer Web

  • improve navigation in capa Explorer Web @s-ff #2425

Raw diffs

Contributors

williballenthin, mr-tz, and 2 other contributors
Assets 6
Loading

v7.3.0

20 Sep 08:43
@mr-tz mr-tz
v7.3.0
d1d8bad
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v7.3.0

The v7.3.0 capa release comes with the following three major enhancements:

1. Support for VMRay sandbox analysis archives

Unlock powerful malware analysis with capa's new VMRay sandbox integration! Simply provide a VMRay analysis archive, and capa will automatically extract and match capabilities to streamline your workflow. This is the second support for the analysis of dynamic analysis results after CAPE.

2. Support for BinExport files generated by Ghidra

BinExport files store disassembled data into a Protocol Buffer format. capa now supports the analysis of BinExport files generated by Ghidra. Using Ghidra and the BinExport file format users can now analyze ARM (AARCH64) ELF files targeting Android.

3. Introducing the capa rules website

You can now browse capa's default rule set at https://mandiant.github.io/capa/rules. In modern terminals the CLI capa tool hyperlinks to resources on the web, including entries on the capa rules website.
Furthermore, https://mandiant.github.io/capa provides a landing page for the capa tool project.

Additional updates

  • capa Explorer Web received several enhancements and bug fixes.
  • Support for the IDA Pro 9.0 IDAPython API while keeping compatibility to older IDA Pro versions
  • Six rules have been added and two rules have been updated

Thanks to @r-sm2024 for their contribution in #2155 and their further work. And of course a big thanks to the community for reporting issues, participating in discussions, and supporting the capa tool and capa rules.

New Features

New Rules (6)

Bug Fixes

capa explorer IDA Pro plugin

  • update IDAPython to IDA Pro 9.0 @mr-tz
  • fix byte search IDA Pro 7.5 compatibility @mr-tz #2371

Raw diffs

Contributors

williballenthin, mr-tz, and 5 other contributors
Assets 6
Loading

v7.2.0

20 Aug 18:15
@mr-tz mr-tz
v7.2.0
f6b7582
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v7.2.0

capa v7.2.0 introduces a first version of capa explorer web: a web-based user interface to inspect capa results using your browser. Users can inspect capa result JSON documents in an online web instance or a standalone HTML page for offline usage. capa explorer supports interactive exploring of capa results to make it easier to understand them. Users can filter, sort, and see the details of all identified capabilities. capa explorer web was worked on by @s-ff as part of a GSoC project, and it is available at https://mandiant.github.io/capa/explorer/#/.

This release also adds a feature extractor for output from the DRAKVUF sandbox. Now, analysts can pass the resulting drakmon.log file to capa and extract capabilities from the artifacts captured by the sandbox. This feature extractor will also be added to the DRAKVUF sandbox as a post-processing script, and it was worked on by @yelhamer as part of a GSoC project.

Additionally, we fixed several bugs handling ELF files, and added the ability to filter capa analysis by functions or processes. We also added support to the IDA Pro extractor to leverage analyst recovered API names.

Special thanks to our repeat and new contributors:

New Features

  • webui: explore capa analysis results in a web-based UI online and offline #2224 @s-ff
  • support analyzing DRAKVUF traces #2143 @yelhamer
  • IDA extractor: extract names from dynamically resolved APIs stored in renamed global variables #2201 @Ana06
  • cli: add the ability to select which specific functions or processes to analyze @yelhamer

Breaking Changes

New Rules (5)

Bug Fixes

capa explorer IDA Pro plugin

Development

  • CI: use macos-12 since macos-11 is deprecated and will be removed on June 28th, 2024 #2173 @mr-tz
  • CI: update Binary Ninja version to 4.1 and use Python 3.9 to test it #2211 @xusheng6
  • CI: update tests.yml workflow to exclude web and documentation files #2263 @s-ff
  • CI: update build.yml workflow to exclude web and documentation files #2270 @s-ff

Raw diffs

Contributors

williballenthin, Ana06, and 8 other contributors
Assets 6
Loading

v7.1.0

14 Jun 11:00
@mr-tz mr-tz
v7.1.0
482686a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v7.1.0

The v7.1.0 release brings large performance improvements to capa's rule matching engine.
Additionally, we've fixed various bugs and added new features for people using and developing capa.

This capa version now supports Python 3.12.

Special thanks to our repeat and new contributors:

New Features

New Rules (25)

Bug Fixes

capa explorer IDA Pro plugin

  • replace deprecated IDA API find_binary with bin_search #1606 @s-ff

Development

  • ci: Fix PR review in the changelog check GH action #2004 @Ana06
  • ci: use rules number badge stored in our bot gist and generated using schneegans/dynamic-badges-action #2001 capa-rules#882 @Ana06
  • ci: update github workflows to use latest version of actions that were using a deprecated version of node #1967 #2003 capa-rules#883 @sjha2048 @Ana06
  • ci: update binja version to stable 4.0 #2016 @xusheng6
  • ci: update github workflows to reflect the latest ghidrathon installation and bumped up jep, ghidra versions #2020 @psahithireddy
  • ci: include rule caching in PyInstaller build process #2097 @s-ff
  • add deptry support #1497 @s-ff

Raw diffs

Contributors

williballenthin, Ana06, and 13 other contributors
Assets 6
Loading

v7.0.1

02 Feb 10:23
@mr-tz mr-tz
v7.0.1
2ddb6b0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v7.0.1

This release fixes a circular import error when using capa as a library.

Bug Fixes

Raw diffs

Contributors

williballenthin
Assets 6
Loading

v7.0.0

01 Feb 14:26
@mr-tz mr-tz
v7.0.0
a3a8e36
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v7.0.0

This is the v7.0.0 release of capa which was mainly worked on during the Google Summer of Code (GSoC) 2023. A huge
shoutout to our GSoC contributors @colton-gabertan and @yelhamer for their amazing work. See our blog posts for more details:

Also, a big thanks to the other contributors: @aaronatp, @Aayush-Goel-04, @bkojusner, @doomedraven, @ruppde, @larchchen, @JCoonradt, and @xusheng6.

New Features

Breaking Changes

New Rules (41)

Bug Fixes

capa explorer IDA Pro plugin

  • various integration updates and minor bug fixes

Development

Developer Notes

With this new release, many classes and concepts have been split up into static (mostly identical to the
prior implementations) and dynamic ones. For example, the legacy FeatureExtractor class has been renamed to
StaticFeatureExtractor and the DynamicFeatureExtractor has been added.

Starting from version 7.0, we have moved the component responsible for feature extractor from main to a new
capabilities' module. Now, users wishing to utilize capa’s feature extraction abilities should use that module instead
of importing the relevant logic from the main file.

For sandbox-based feature extractors, we are using Pydantic models. Contributions of more models for other sandboxes
are very welcome!

With this release we've reorganized the logic found in main() to localize logic and ease readability and ease changes
and integrations. The new "main routines" are expected to be used only within main functions, either capa main or
related scripts. These functions should not be invoked from library code.

Beyond copying code around, we've refined the handling of the input file/format/backend. The logic for picking the
format and backend is more consistent. We've documented that the input file is not necessarily the sample itself
(cape/freeze/etc.) inputs are not actually the sample.

Raw diffs

Contributors

williballenthin, gmacon, and 14 other contributors
Assets 6
Loading

v7.0.0-beta

24 Jan 13:59
@mr-tz mr-tz
v7.0.0-beta
85e1495
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v7.0.0-beta Pre-release
Pre-release

This is the beta release of capa v7.0 which was mainly worked on during the Google Summer of Code (GSoC) 2023. A huge
shoutout to @colton-gabertan and @yelhamer for their amazing work.

Also a big thanks to the other contributors: @aaronatp, @Aayush-Goel-04, @bkojusner, @doomedraven, @ruppde, and @xusheng6.

New Features

Breaking Changes

  • remove the SCOPE_* constants in favor of the Scope enum #1764 @williballenthin
  • protobuf: deprecate RuleMetadata.scope in favor of RuleMetadata.scopes @williballenthin
  • protobuf: deprecate Metadata.analysis in favor of Metadata.analysis2 that is dynamic analysis aware @williballenthin
  • update freeze format to v3, adding support for dynamic analysis @williballenthin
  • extractor: ignore DLL name for api features #1815 @mr-tz

New Rules (41)

Bug Fixes

Development

Developer Notes

With this new release, many classes and concepts have been split up into static (mostly identical to the
prior implementations) and dynamic ones. For example, the legacy FeatureExtractor class has been renamed to
StaticFeatureExtractor and the DynamicFeatureExtractor has been added.

Starting from version 7.0, we have moved the component responsible for feature extractor from main to a new
capabilities' module. Now, users wishing to utilize capa’s feature extraction abilities should use that module instead
of importing the relevant logic from the main file.

For sandbox-based feature extractors, we are using Pydantic models. Contributions of more models for other sandboxes
are very welcome!

Raw diffs

Contributors

williballenthin, gmacon, and 12 other contributors
Assets 6
Loading

v6.1.0

25 Aug 09:12
@williballenthin williballenthin
v6.1.0
9d21add
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v6.1.0

capa v6.1.0 is a bug fix release, most notably fixing unhandled exceptions in the capa explorer IDA Pro plugin. @Aayush-Goel-04 put a lot of effort into improving code quality and adding a script for rule authors. The script shows which features are present in a sample but not referenced by any existing rule. You could use this script to find opportunities for new rules.

Speaking of new rules, we have eight additions, coming from Ronnie, Jakub, Moritz, Ervin, and still@teamt5.org!

New Features

New Rules (8)

Modified rules (9)

Renamed rules (1)

Bug Fixes

capa explorer IDA Pro plugin

EDIT: a standalone binary created using Python 3.11 is now available.

Raw diffs

Contributors

williballenthin, mr-tz, and 4 other contributors
Assets 6
Loading