Jump to content

capa v3.0.0


Recommended Posts

We are excited to announce version 3.0! ?

capa 3.0:

  • adds support for ELF files targeting Linux thanks to Intezer
  • adds new features to specify OS, CPU architecture, and file format
  • fixes a few bugs that may have led to false negatives (missed capabilities) in older versions
  • adds 80 new rules, including 36 describing techniques for Linux

A huge thanks to everyone who submitted issues, provided feedback, and contributed code and rules.
Special acknowledgement to @Adir-Shemesh and @TcM1911 of Intezer for contributing the code to enable ELF support.
Also, welcome first time contributors:

New Features

Breaking Changes

  • rules using format, arch, os, or substring features cannot be used by capa versions prior to v3
  • legacy term arch (i.e., "x32") is now called bitness @williballenthin
  • freeze format gains new section for "global" features #759 @williballenthin

New Rules (80)

Bug Fixes

  • main: fix KeyError: 0 when reporting results @williballehtin #703
  • main: fix potential false negatives due to namespaces across scopes @williballenthin #721
  • linter: suppress some warnings about imports from ntdll/ntoskrnl @williballenthin #743
  • linter: suppress some warnings about missing examples in the nursery @williballenthin #747

capa explorer IDA Pro plugin

  • explorer: add additional filter logic when displaying matches by function #686 @mike-hunhoff
  • explorer: remove duplicate check when saving file #687 @mike-hunhoff
  • explorer: update IDA extractor to use non-canon mnemonics #688 @mike-hunhoff
  • explorer: allow user to add specified number of bytes when adding a Bytes feature in the Rule Generator #689 @mike-hunhoff
  • explorer: enforce max column width Features and Editor panes #691 @mike-hunhoff
  • explorer: add option to limit features to currently selected disassembly address #692 @mike-hunhoff
  • explorer: update support documentation and runtime checks #741 @mike-hunhoff
  • explorer: small performance boost to rule generator search functionality #742 @mike-hunhoff
  • explorer: add support for arch, os, and format features #758 @mike-hunhoff
  • explorer: improve parsing algorithm for rule generator feature editor #768 @mike-hunhoff


Raw diffs


Link to comment
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Create New...