Jump to content

capa v1.3.0


Recommended Posts

v1.3.0 (2020-09-14)

This release brings newly updated mappings to the Malware Behavior Catalog version 2.0, many enhancements to the IDA Pro plugin, flare-capa on PyPI, a bunch of bug fixes to improve feature extraction, and four new rules. We received contributions from ten reverse engineers, including seven new ones:

Download a standalone binary below and checkout the readme here on GitHub. Report issues on our issue tracker and contribute new rules at capa-rules.

Key changes to IDA Plugin

The IDA Pro integration is now distributed as a real plugin, instead of a script. This enables a few things:

  • keyboard shortcuts and file menu integration
  • updates distributed PyPI/pip install --upgrade without touching your %IDADIR%
  • generally doing thing the "right way"

How to get this new version? Its easy: download capa_explorer.py to your IDA plugins directory and update your capa installation (incidentally, this is a good opportunity to migrate to pip install flare-capa instead of git checkouts). Now you should see the plugin listed in the Edit > Plugins > FLARE capa explorer menu in IDA.

Please refer to the plugin readme for additional information on installing and using the IDA Pro plugin.

Please open an issue in this repository if you notice anything weird.

New features

New rules

Bug fixes


  • rules: update meta mapping to MBC 2.0! @dzbeck
  • render: don't display rules that are also matched by other rules @williballenthin @Ana06 #224
  • ida plugin: simplify tabs, removing summary and adding detail to results view @williballenthin #286
  • ida plugin: analysis is no longer automatically started when plugin is first opened @mike-hunhoff #304
  • ida plugin: user must manually select a capa rules directory before analysis can be performed @mike-hunhoff
  • ida plugin: user interface controls are disabled until analysis is performed @mike-hunhoff #304

Raw diffs


Link to comment
Share on other sites


This topic is now archived and is closed to further replies.

  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Create New...