Jump to content

capa v1.1.0


Recommended Posts

This release brings new rule format updates, such as adding offset/x32 and negative offsets, fixes some bugs identified by the community, and 28 (!) new rules. We received contributions from eight reverse engineers, including four new ones:

Download a standalone binary below and checkout the readme here on GitHub. Report issues on our issue tracker and contribute new rules at capa-rules.

New features

New rules

Bug fixes


  • doc: explain how to bypass gatekeeper on macOS @psifertex
  • doc: explain supported linux distributions @Ana06
  • doc: explain submodule update with --init @psifertex
  • main: improve program help output @mr-tz
  • main: disable progress when run in quiet mode @mr-tz
  • main: assert supported IDA versions @mr-tz
  • extractor: better identify nested pointers to strings @williballenthin
  • setup: specify vivisect download url @Ana06
  • setup: pin vivisect version @williballenthin
  • setup: bump vivisect dependency version @williballenthin
  • setup: set Python project name to flare-capa @williballenthin
  • ci: run tests and linter via Github Actions @Ana06
  • hooks: run style checkers and hide stashed output @Ana06
  • linter: ignore period in rule filename @williballenthin
  • linter: warn on nursery rule with no changes needed @williballenthin

Raw diffs


Link to comment
Share on other sites


This topic is now archived and is closed to further replies.

  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Create New...