mandiant / capa

The FLARE team's open-source tool to identify capabilities in executable files.
Apache License 2.0
4.01k stars 505 forks source link

updates capa_explorer.py, enabling the user to choose b/w having bookmarks & comments. #2029

Open Atlas-64 opened 4 months ago

Atlas-64 commented 4 months ago

Updates capa_explorer.py to let users choose between adding bookmarks/comments when the script is executed. Uses the Ghidra's askChoices API to do so.

closes issue: #1977

Checklist

mike-hunhoff commented 4 months ago

@Atlas-64 thank you for your contribution! Let's get the lint errors fixed before we review. Have you followed the capa development installation steps? Specifically, these steps outline how to use pre-commit resolve linting issues locally. Please let us know here if you have/had issues running pre-commit locally. Also, please add an entry to CHANGELOG.md with a short description of the PR.

Atlas-64 commented 4 months ago

hi @mike-hunhoff i did follow the steps to install my version of capa (in editable mode) and the dependencies and then continued to run the pre commit command to see if it passes the linting issues but i cant seem to pinpoint what do we do to import askChoices for use in capa_ghidra() which is why it seems that on the ruff hook it throws me the following error : image i have tried going through the api documentation and even trying to run it in a seperately defined function where all the user i/o would take place (referencing it self for invoking everytime it runs the script) ,But i keep encountering that specific wall . i think after fixing the imlementation of the askchoices api everything should work well, i can make a change to the changelog and run further ghidra specific tests and post it in this PR any help steering the solve in the right direction would be appreciated . Thanks in advance

mike-hunhoff commented 4 months ago

hi @mike-hunhoff i did follow the steps to install my version of capa (in editable mode) and the dependencies and then continued to run the pre commit command to see if it passes the linting issues but i cant seem to pinpoint what do we do to import askChoices for use in capa_ghidra() which is why it seems that on the ruff hook it throws me the following error : image i have tried going through the api documentation and even trying to run it in a seperately defined function where all the user i/o would take place (referencing it self for invoking everytime it runs the script) ,But i keep encountering that specific wall . i think after fixing the imlementation of the askchoices api everything should work well, i can make a change to the changelog and run further ghidra specific tests and post it in this PR any help steering the solve in the right direction would be appreciated . Thanks in advance

Thank you for your thorough explanation! You're encountering a side effect of the way Ghidrathon adds Ghidra FlatProgramAPI methods (e.g. askChoices) to the Python built-in scope. Linting tools including ruff complain because there is no explicit definition or import statement mapping to the method. Our current solution is to force our linters to ignore this specific linting error by adding the comment # type: ignore [name-defined] # noqa: F821 at the end of affected lines, e.g. the add_bookmark helper function found in capa_explorer.py.

Atlas-64 commented 3 months ago

@mike-hunhoff sorry for the absence have been busy with school, I think I will try running the changed version and see if its working alright, and then move on to actually running the tests against it . Will post screenshots here of the results