mandiant / capa

The FLARE team's open-source tool to identify capabilities in executable files.
https://mandiant.github.io/capa/
Apache License 2.0
4.79k stars 554 forks source link

ida-explorer: Update test_ida_features.py to run with pytest #1751

Open colton-gabertan opened 1 year ago

colton-gabertan commented 1 year ago

Description

We've bumped the version of pytest in our dependencies to 7.4.0. The current implementation of the IDA test script uses yield, which has been deprecated since pytest v4.

https://github.com/mandiant/capa/blob/934d0f969b00bf4b8b87e46ffc15cedea306dbe3/tests/test_ida_features.py#L111C9-L127C46

        try:
            check_input_file(fixtures.get_sample_md5_by_name(sample))
        except RuntimeError:
            yield this_name, id, "skip", None
            continue

        scope = fixtures.resolve_scope(scope)
        sample = fixtures.resolve_sample(sample)

        try:
            fixtures.do_test_feature_presence(get_ida_extractor, sample, scope, feature, expected)
        except Exception:
            f = io.StringIO()
            traceback.print_exc(file=f)
            yield this_name, id, "fail", f.getvalue()
        else:
            yield this_name, id, "pass", None

Additional Information

Due to similarities in how the IDA and Ghidra backends are invoked, see:

https://github.com/mandiant/capa/blob/058c1fefd2ddb9e2c01d16b104c1848729c8353b/tests/test_ghidra_features.py

This may help in providing a model to update the IDA test script.

williballenthin commented 1 year ago

i think this is closed in #1728? or did i botch it?

colton-gabertan commented 1 year ago

i think this is closed in #1728? or did i botch it?

Oh sorry I didn't see the full changes! It seems we've taken different approaches in getting the Ghidra and IDA unit tests to run. Would it be better to leave IDA as its own yield test, or to have it run via pytest? If so we can close this issue 👍

williballenthin commented 1 year ago

did you get pytest running in IDA? if so, your approach is good. otherwise, we have a hacky setup that sorta kinda looks like pytest but isn't nearly as good.