Comments (9)
Hm, interesting. For consistency doing it the same way for all features would be good. If the parsing becomes to annoying or the syntax to cumbersome, this string / context (description) could work well:
- string: everything and anything
description: my description
- number: 16
description: a good number
from capa.
We have discussed to support the following syntax:
- string: "'This program cannot be run in DOS mode.' = MS-DOS stub message"
I have been thinking about how to implementent htis and I think this brings some problems as well. What if the string or the description contains '
or "
?
I am tending to think that it would be better/easier to allow a way to scape the =
, for example \=
or to only support it in regular expressions.
This proposal is easy to parse:
value, symbol = s.split(' = ', 1)
value.replace('\=', '=')
@williballenthin @mr-tz what do you think? Do you have a better idea to deal with '
or "
?
from capa.
I think there's an edge case here:
value.replace('\=', '=')
what happens if the string should contain the literal \=
?
from capa.
what if we enabled string
to also be a sequence of two elements, like:
- string:
- This program can't be run in DOS mode
- MS-DOS stub message
im not sure if this is legal, but might be more readable:
- string: This program can't be run in DOS mode
- MS-DOS stub message
from capa.
from capa.
that looks pretty good to me.
i still like the shorthand 16 = a good number
, but it doesn't work in some cases (strings). we could do our best, and then use the linter to warn/fail when a term is ambiguous?
from capa.
In that case I'd say we go with 17 = also a good number
for all features until someone break it with a good use-case 😃
from capa.
what happens if the string should contain the literal =?
\\=
, escaping the =
Maybe we never have a rule with an =
in a string. I don't think that it is worthwhile to complicate the syntax for all features just for this case.
I have another proposal. What about splitting using the last =
surrounded by spaces? which means that all characters (including =
) are allowed in the string, but =
surrounded by spaces is not allowed in the description. I can't come up with any case where a description should have an =
. I could add a linter which complains if there are more than one and the type is not string (and maybe a warning for string).
from capa.
from offline decision:
for all features but string, continue to support inline description using =
. for string, the parsing is too complex to be worth it right now.
therefore, for all features, including string, also support description:
.
the second form is the only way to describe a string. for other features, its use is discouraged, unless the description is long.
from capa.
Related Issues (20)
- SARIF script mypy failures HOT 1
- Add support for VMRay sandbox results for capa dynamic analysis
- cape: fix incomplete f-strings
- webui: sort display by column
- webui: show numbers as hex
- webui: don't show library rules (by default)
- webui: indicate number of matches per rule HOT 2
- webui: search/filter over rule names, namespaces, and features HOT 3
- webui: group rule hits by function HOT 1
- Drakvuf Sandbox Feature Extractor
- webui: deciding on a development approach HOT 2
- Drakvuf Feature Extractor File Features
- OverflowError:
- webui: comparative review of the potential libraries to use HOT 1
- webui: demonstrate building a standalone page based on Vue.js implementation HOT 3
- Update macos-11
- Implement existing capa explorer webui using Vue.js HOT 3
- Use same sample for Drakvuf and CAPE testing
- Add support for more Drakvuf plugins HOT 2
- Include web UI HTML in release/distribution and hint to it in tool options/output
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from capa.