The FLARE team's open-source tool to identify capabilities in executable files.
This report summarizes scanner evidence for mandiant/capa, a Python project with 6,224 GitHub stars. SynthScan examined 68,180 lines of code across 301 source files, recording 1251 pattern matches distributed across 18 syntactic categories. The legacy adjusted pattern signal is 51.5 (High pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 859 finding(s).
Are imports declared and package/API names verified? 208 finding(s).
Are wrappers, guards, and repeated structures necessary? 638 finding(s).
Which changes need focused human review? 1251 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 1251 distinct pattern matches across 18 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | web/explorer/src/components/MetadataPanel.vue | 102 | const fileName = props.data.meta.sample.path.split("/").pop(); | CODE |
| CRITICAL | web/rules/public/js/jquery-3.5.1.slim.min.js | 18 | !function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):f | CODE |
| CRITICAL⚡ | capa/loader.py | 289 | return capa.features.extractors.cape.extractor.CapeExtractor.from_report(report) | CODE |
| CRITICAL⚡ | capa/loader.py | 295 | return capa.features.extractors.drakvuf.extractor.DrakvufExtractor.from_report(report) | CODE |
| CRITICAL⚡ | capa/loader.py | 300 | return capa.features.extractors.vmray.extractor.VMRayExtractor.from_zipfile(input_path) | CODE |
| CRITICAL⚡ | capa/loader.py | 308 | return capa.features.extractors.dnfile.extractor.DnfileFeatureExtractor(input_path) | CODE |
| CRITICAL⚡ | capa/loader.py | 541 | file_extractors.append(capa.features.extractors.cape.extractor.CapeExtractor.from_report(report)) | CODE |
| CRITICAL⚡ | capa/loader.py | 548 | file_extractors.append(capa.features.extractors.drakvuf.extractor.DrakvufExtractor.from_report(report)) | CODE |
| CRITICAL⚡ | capa/loader.py | 553 | file_extractors.append(capa.features.extractors.vmray.extractor.VMRayExtractor.from_zipfile(input_file)) | CODE |
| CRITICAL | capa/loader.py | 338 | return capa.features.extractors.binja.extractor.BinjaFeatureExtractor(bv) | CODE |
| CRITICAL | capa/loader.py | 371 | return capa.features.extractors.viv.extractor.VivisectFeatureExtractor(vw, input_path, os_) | CODE |
| CRITICAL | capa/loader.py | 384 | return capa.features.extractors.binexport2.extractor.BinExport2FeatureExtractor(be2, buf) | CODE |
| CRITICAL | capa/loader.py | 423 | return capa.features.extractors.ida.extractor.IdaFeatureExtractor() | CODE |
| CRITICAL | capa/loader.py | 487 | return capa.features.extractors.ghidra.extractor.GhidraFeatureExtractor(ctx_manager=cm, tmpdir=tmpdir) | CODE |
| CRITICAL | capa/main.py | 1093 | capabilities = find_capabilities(rules, capa.features.extractors.ida.extractor.IdaFeatureExtractor()) | STRING |
| CRITICAL | capa/main.py | 1126 | capa.features.extractors.ghidra.context.set_context(program, flat_api, monitor_) | STRING |
| CRITICAL | capa/main.py | 1143 | capa.features.extractors.ghidra.extractor.GhidraFeatureExtractor(), | STRING |
| CRITICAL⚡ | capa/features/extractors/viv/extractor.py | 51 | self.global_features.extend(capa.features.extractors.viv.file.extract_file_format(self.buf)) | CODE |
| CRITICAL⚡ | capa/features/extractors/viv/extractor.py | 53 | self.global_features.extend(capa.features.extractors.viv.global_.extract_arch(self.vw)) | CODE |
| CRITICAL⚡ | capa/features/extractors/viv/extractor.py | 63 | yield from capa.features.extractors.viv.file.extract_features(self.vw, self.buf) | CODE |
| CRITICAL⚡ | capa/features/extractors/viv/extractor.py | 73 | yield from capa.features.extractors.viv.function.extract_features(fh) | CODE |
| CRITICAL⚡ | capa/features/extractors/viv/extractor.py | 83 | yield from capa.features.extractors.viv.basicblock.extract_features(fh, bbh) | CODE |
| CRITICAL | capa/features/extractors/viv/extractor.py | 95 | yield from capa.features.extractors.viv.insn.extract_features(fh, bbh, ih) | CODE |
| CRITICAL | capa/features/extractors/viv/insn.py | 100 | target = capa.features.extractors.viv.helpers.get_coderef_from(f.vw, insn.va) | CODE |
| CRITICAL | capa/features/extractors/viv/insn.py | 151 | target = capa.features.extractors.viv.helpers.get_coderef_from(f.vw, target) | CODE |
| CRITICAL | capa/features/extractors/dnfile/extractor.py | 111 | yield from capa.features.extractors.dnfile.file.extract_features(self.pe) | CODE |
| CRITICAL⚡ | capa/features/extractors/dnfile/extractor.py | 157 | yield from capa.features.extractors.dnfile.function.extract_features(fh) | CODE |
| CRITICAL | capa/features/extractors/dnfile/extractor.py | 178 | yield from capa.features.extractors.dnfile.insn.extract_features(fh, bbh, ih) | CODE |
| CRITICAL⚡ | capa/features/extractors/drakvuf/extractor.py | 52 | self.global_features = list(capa.features.extractors.drakvuf.global_.extract_features(self.report)) | CODE |
| CRITICAL⚡ | capa/features/extractors/drakvuf/extractor.py | 62 | yield from capa.features.extractors.drakvuf.file.extract_features(self.report) | CODE |
| CRITICAL⚡ | capa/features/extractors/drakvuf/extractor.py | 65 | yield from capa.features.extractors.drakvuf.file.get_processes(self.sorted_calls) | CODE |
| CRITICAL⚡ | capa/features/extractors/drakvuf/extractor.py | 68 | yield from capa.features.extractors.drakvuf.process.extract_features(ph) | CODE |
| CRITICAL⚡ | capa/features/extractors/drakvuf/extractor.py | 74 | yield from capa.features.extractors.drakvuf.process.get_threads(self.sorted_calls, ph) | CODE |
| CRITICAL⚡ | capa/features/extractors/drakvuf/extractor.py | 80 | yield from capa.features.extractors.drakvuf.thread.get_calls(self.sorted_calls, ph, th) | CODE |
| CRITICAL | capa/features/extractors/drakvuf/extractor.py | 96 | yield from capa.features.extractors.drakvuf.call.extract_features(ph, th, ch) | CODE |
| CRITICAL⚡ | capa/features/extractors/ida/extractor.py | 46 | self.global_features.extend(capa.features.extractors.ida.file.extract_file_format()) | CODE |
| CRITICAL⚡ | capa/features/extractors/ida/extractor.py | 47 | self.global_features.extend(capa.features.extractors.ida.global_.extract_os()) | CODE |
| CRITICAL⚡ | capa/features/extractors/ida/extractor.py | 48 | self.global_features.extend(capa.features.extractors.ida.global_.extract_arch()) | CODE |
| CRITICAL⚡ | capa/features/extractors/ida/extractor.py | 57 | yield from capa.features.extractors.ida.file.extract_features() | CODE |
| CRITICAL⚡ | capa/features/extractors/ida/extractor.py | 71 | yield from capa.features.extractors.ida.function.extract_features(fh) | CODE |
| CRITICAL⚡ | capa/features/extractors/ida/extractor.py | 80 | yield from capa.features.extractors.ida.basicblock.extract_features(fh, bbh) | CODE |
| CRITICAL⚡ | capa/features/extractors/ida/extractor.py | 89 | yield from capa.features.extractors.ida.insn.extract_features(fh, bbh, ih) | CODE |
| CRITICAL | capa/features/extractors/ida/file.py | 55 | for off in capa.features.extractors.ida.helpers.find_byte_sequence(seg.start_ea, seg.end_ea, mzx): | CODE |
| CRITICAL | capa/features/extractors/ida/file.py | 88 | for seg in capa.features.extractors.ida.helpers.get_segments(skip_header_segments=True): | CODE |
| CRITICAL | capa/features/extractors/ida/file.py | 118 | for ea, info in capa.features.extractors.ida.helpers.get_file_imports().items(): | CODE |
| CRITICAL⚡ | capa/features/extractors/ida/file.py | 139 | for ea, info in capa.features.extractors.ida.helpers.get_file_externs().items(): | CODE |
| CRITICAL⚡ | capa/features/extractors/ida/file.py | 150 | for seg in capa.features.extractors.ida.helpers.get_segments(skip_header_segments=True): | CODE |
| CRITICAL | capa/features/extractors/ida/file.py | 161 | for seg in capa.features.extractors.ida.helpers.get_segments(): | CODE |
| CRITICAL | capa/features/extractors/ida/file.py | 162 | seg_buff = capa.features.extractors.ida.helpers.get_segment_buffer(seg) | CODE |
| CRITICAL | capa/features/extractors/ida/basicblock.py | 33 | op_val = capa.features.extractors.ida.helpers.mask_op_val(op) | CODE |
| CRITICAL | capa/features/extractors/ida/basicblock.py | 82 | for insn in capa.features.extractors.ida.helpers.get_instructions_in_range(bb.start_ea, bb.end_ea): | CODE |
| CRITICAL | capa/features/extractors/ida/basicblock.py | 98 | if capa.features.extractors.ida.helpers.is_basic_block_tight_loop(bbh.inner): | CODE |
| CRITICAL | capa/features/extractors/ida/function.py | 50 | if capa.features.extractors.ida.helpers.is_function_recursive(fh.inner): | CODE |
| CRITICAL | capa/features/extractors/ida/function.py | 73 | for aname in capa.features.extractors.ida.helpers.get_function_alternative_names(fh.inner.start_ea): | CODE |
| CRITICAL⚡ | capa/features/extractors/ida/insn.py | 207 | ref = capa.features.extractors.ida.helpers.find_data_reference_from_insn(insn) | CODE |
| CRITICAL⚡ | capa/features/extractors/ida/insn.py | 209 | extracted_bytes = capa.features.extractors.ida.helpers.read_bytes_at(ref, MAX_BYTES_FEATURE_SIZE) | CODE |
| CRITICAL⚡ | capa/features/extractors/ida/insn.py | 211 | if not capa.features.extractors.ida.helpers.find_string_at(ref): | CODE |
| CRITICAL⚡ | capa/features/extractors/ida/insn.py | 227 | ref = capa.features.extractors.ida.helpers.find_data_reference_from_insn(insn) | CODE |
| CRITICAL⚡ | capa/features/extractors/ida/insn.py | 229 | found = capa.features.extractors.ida.helpers.find_string_at(ref) | CODE |
| CRITICAL⚡ | capa/features/extractors/ida/insn.py | 334 | for insn in capa.features.extractors.ida.helpers.get_instructions_in_range(bb.start_ea, bb.end_ea): | CODE |
| 115 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | web/explorer/src/utils/rdocParser.js | 137 | function createAdditionalMatchesNode(index, additionalMatchCount) { | CODE |
| LOW | web/explorer/src/utils/rdocParser.js | 262 | export function parseFunctionCapabilities(doc) { | CODE |
| LOW | web/explorer/src/utils/rdocParser.js | 429 | function invertNotStatementSuccess(node) { | CODE |
| LOW | capa/main.py | 194 | def simple_message_exception_handler( | CODE |
| LOW | capa/main.py | 523 | def ensure_input_exists_from_cli(args): | CODE |
| LOW | capa/main.py | 540 | def get_input_format_from_cli(args) -> str: | CODE |
| LOW | capa/main.py | 713 | def get_file_extractors_from_cli(args, input_format: str) -> list[FeatureExtractor]: | CODE |
| LOW | capa/main.py | 759 | def find_static_limitations_from_cli(args, rules: RuleSet, file_extractors: list[FeatureExtractor]): | CODE |
| LOW | capa/main.py | 792 | def find_dynamic_limitations_from_cli(args, rules: RuleSet, file_extractors: list[FeatureExtractor]): | CODE |
| LOW | capa/main.py | 910 | def get_extractor_filters_from_cli(args, input_format) -> FilterConfig: | CODE |
| LOW | capa/helpers.py | 223 | def get_format_from_extension(sample: Path) -> str: | CODE |
| LOW | capa/helpers.py | 270 | def log_unsupported_format_error(): | CODE |
| LOW | capa/helpers.py | 280 | def log_unsupported_cape_report_error(error: str): | CODE |
| LOW | capa/helpers.py | 291 | def log_unsupported_drakvuf_report_error(error: str): | CODE |
| LOW | capa/helpers.py | 302 | def log_unsupported_vmray_report_error(error: str): | CODE |
| LOW | capa/helpers.py | 313 | def log_empty_sandbox_report_error(error: str, sandbox_name: str): | CODE |
| LOW | capa/helpers.py | 337 | def log_unsupported_arch_error(): | CODE |
| LOW | capa/helpers.py | 376 | def is_cache_newer_than_rule_code(cache_dir: Path) -> bool: | CODE |
| LOW | capa/capabilities/dynamic.py | 221 | def find_process_capabilities( | CODE |
| LOW | capa/capabilities/dynamic.py | 271 | def find_dynamic_capabilities( | CODE |
| LOW | capa/capabilities/common.py | 111 | def is_static_limitation_rule(r: Rule) -> bool: | CODE |
| LOW | capa/capabilities/common.py | 120 | def is_dynamic_limitation_rule(r: Rule) -> bool: | CODE |
| LOW | capa/capabilities/static.py | 39 | def find_instruction_capabilities( | CODE |
| LOW | capa/capabilities/static.py | 71 | def find_basic_block_capabilities( | CODE |
| LOW | capa/features/extractors/pefile.py | 36 | def extract_file_export_names(pe, **kwargs): | CODE |
| LOW | capa/features/extractors/pefile.py | 63 | def extract_file_import_names(pe, **kwargs): | CODE |
| LOW | capa/features/extractors/pefile.py | 95 | def extract_file_section_names(pe, **kwargs): | CODE |
| LOW | capa/features/extractors/pefile.py | 111 | def extract_file_function_names(**kwargs): | CODE |
| LOW | capa/features/extractors/pefile.py | 217 | def extract_function_features(self, fh): | CODE |
| LOW | capa/features/extractors/pefile.py | 223 | def extract_basic_block_features(self, fh, bbh): | CODE |
| LOW | capa/features/extractors/null.py | 82 | def extract_function_features(self, fh): | CODE |
| LOW | capa/features/extractors/null.py | 90 | def extract_basic_block_features(self, fh, bbh): | CODE |
| LOW | capa/features/extractors/base_extractor.py | 223 | def extract_function_features(self, fh: FunctionHandle) -> Iterator[tuple[Feature, Address]]: | CODE |
| LOW | capa/features/extractors/base_extractor.py | 252 | def extract_basic_block_features(self, fh: FunctionHandle, bbh: BBHandle) -> Iterator[tuple[Feature, Address]]: | CODE |
| LOW | capa/features/extractors/elf.py | 906 | def guess_os_from_ident_directive(elf: ELF) -> Optional[OS]: | CODE |
| LOW | capa/features/extractors/elf.py | 962 | def guess_os_from_abi_versions_needed(elf: ELF) -> Optional[OS]: | CODE |
| LOW | capa/features/extractors/elf.py | 995 | def guess_os_from_needed_dependencies(elf: ELF) -> Optional[OS]: | CODE |
| LOW | capa/features/extractors/elf.py | 1116 | def guess_os_from_go_buildinfo(elf: ELF) -> Optional[OS]: | CODE |
| LOW | capa/features/extractors/elf.py | 1450 | def guess_os_from_vdso_strings(elf: ELF) -> Optional[OS]: | CODE |
| LOW | capa/features/extractors/dotnetfile.py | 66 | def extract_file_import_names(pe: dnfile.dnPE, **kwargs) -> Iterator[tuple[Import, Address]]: | CODE |
| LOW | capa/features/extractors/dotnetfile.py | 77 | def extract_file_function_names(pe: dnfile.dnPE, **kwargs) -> Iterator[tuple[FunctionName, Address]]: | CODE |
| LOW | capa/features/extractors/dotnetfile.py | 82 | def extract_file_namespace_features(pe: dnfile.dnPE, **kwargs) -> Iterator[tuple[Namespace, Address]]: | CODE |
| LOW | capa/features/extractors/dotnetfile.py | 106 | def extract_file_class_features(pe: dnfile.dnPE, **kwargs) -> Iterator[tuple[Class, Address]]: | CODE |
| LOW | capa/features/extractors/dotnetfile.py | 158 | def extract_file_mixed_mode_characteristic_features( | CODE |
| LOW | capa/features/extractors/dotnetfile.py | 249 | def extract_function_features(self, fh): | CODE |
| LOW | capa/features/extractors/dotnetfile.py | 255 | def extract_basic_block_features(self, fh, bbh): | CODE |
| LOW | capa/features/extractors/helpers.py | 92 | def reformat_forwarded_export_name(forwarded_name: str) -> str: | CODE |
| LOW | capa/features/extractors/elffile.py | 33 | def extract_file_export_names(elf: ELFFile, **kwargs): | CODE |
| LOW | capa/features/extractors/elffile.py | 88 | def extract_file_import_names(elf: ELFFile, **kwargs): | CODE |
| LOW | capa/features/extractors/elffile.py | 148 | def extract_file_section_names(elf: ELFFile, **kwargs): | CODE |
| LOW | capa/features/extractors/elffile.py | 243 | def extract_function_features(self, fh): | CODE |
| LOW | capa/features/extractors/elffile.py | 249 | def extract_basic_block_features(self, fh, bbh): | CODE |
| LOW | capa/features/extractors/viv/indirect_calls.py | 38 | def get_previous_instructions(vw: VivWorkspace, va: int) -> list[int]: | CODE |
| LOW⚡ | capa/features/extractors/viv/extractor.py | 72 | def extract_function_features(self, fh: FunctionHandle) -> Iterator[tuple[Feature, Address]]: | CODE |
| LOW⚡ | capa/features/extractors/viv/extractor.py | 82 | def extract_basic_block_features(self, fh: FunctionHandle, bbh) -> Iterator[tuple[Feature, Address]]: | CODE |
| LOW | capa/features/extractors/viv/file.py | 45 | def extract_file_export_names(vw: vivisect.VivWorkspace, **kwargs) -> Iterator[tuple[Feature, Address]]: | CODE |
| LOW | capa/features/extractors/viv/file.py | 66 | def extract_file_import_names(vw, **kwargs) -> Iterator[tuple[Feature, Address]]: | CODE |
| LOW | capa/features/extractors/viv/file.py | 101 | def extract_file_section_names(vw, **kwargs) -> Iterator[tuple[Feature, Address]]: | CODE |
| LOW | capa/features/extractors/viv/file.py | 110 | def extract_file_function_names(vw, **kwargs) -> Iterator[tuple[Feature, Address]]: | CODE |
| LOW | capa/features/extractors/viv/function.py | 29 | def extract_function_symtab_names( | CODE |
| 393 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | capa/features/extractors/pefile.py | 0 | extract function imports 1. imports by ordinal: - modulename.#ordinal 2. imports by name, results in two features to sup | STRING |
| HIGH | capa/features/extractors/viv/file.py | 0 | extract function imports 1. imports by ordinal: - modulename.#ordinal 2. imports by name, results in two features to sup | STRING |
| HIGH | capa/features/extractors/ida/file.py | 0 | extract function imports 1. imports by ordinal: - modulename.#ordinal 2. imports by name, results in two features to sup | STRING |
| HIGH | capa/features/extractors/binja/file.py | 0 | extract function imports 1. imports by ordinal: - modulename.#ordinal 2. imports by name, results in two features to sup | STRING |
| HIGH | capa/features/extractors/ghidra/file.py | 0 | extract function imports 1. imports by ordinal: - modulename.#ordinal 2. imports by name, results in two features to sup | STRING |
| HIGH | capa/features/extractors/pefile.py | 0 | extract the names of statically-linked library functions. | STRING |
| HIGH | capa/features/extractors/viv/file.py | 0 | extract the names of statically-linked library functions. | STRING |
| HIGH | capa/features/extractors/ida/file.py | 0 | extract the names of statically-linked library functions. | STRING |
| HIGH | capa/features/extractors/binja/file.py | 0 | extract the names of statically-linked library functions. | STRING |
| HIGH | capa/features/extractors/ghidra/file.py | 0 | extract the names of statically-linked library functions. | STRING |
| HIGH | capa/features/extractors/viv/basicblock.py | 0 | return string length if all operand bytes are ascii or utf16-le printable | STRING |
| HIGH | capa/features/extractors/ida/basicblock.py | 0 | return string length if all operand bytes are ascii or utf16-le printable | STRING |
| HIGH | capa/features/extractors/binja/function.py | 0 | return string length if all operand bytes are ascii or utf16-le printable | STRING |
| HIGH | capa/features/extractors/ghidra/basicblock.py | 0 | return string length if all operand bytes are ascii or utf16-le printable | STRING |
| HIGH | capa/features/extractors/viv/insn.py | 0 | parse call $+5 instruction from the given instruction. | STRING |
| HIGH | capa/features/extractors/ida/insn.py | 0 | parse call $+5 instruction from the given instruction. | STRING |
| HIGH | capa/features/extractors/binja/insn.py | 0 | parse call $+5 instruction from the given instruction. | STRING |
| HIGH | capa/features/extractors/ghidra/insn.py | 0 | parse call $+5 instruction from the given instruction. | STRING |
| HIGH | capa/features/extractors/ida/basicblock.py | 0 | check basic block for stackstring indicators true if basic block contains enough moves of constant bytes to the stack | STRING |
| HIGH | capa/features/extractors/binja/function.py | 0 | check basic block for stackstring indicators true if basic block contains enough moves of constant bytes to the stack | STRING |
| HIGH | capa/features/extractors/ghidra/basicblock.py | 0 | check basic block for stackstring indicators true if basic block contains enough moves of constant bytes to the stack | STRING |
| HIGH | capa/features/extractors/ida/insn.py | 0 | parse instruction number features example: push 3136b0h ; dwcontrolcode | STRING |
| HIGH | capa/features/extractors/binja/insn.py | 0 | parse instruction number features example: push 3136b0h ; dwcontrolcode | STRING |
| HIGH | capa/features/extractors/ghidra/insn.py | 0 | parse instruction number features example: push 3136b0h ; dwcontrolcode | STRING |
| HIGH | capa/features/extractors/ida/insn.py | 0 | parse referenced byte sequences example: push offset iid_004118d4_ishelllinka ; riid | STRING |
| HIGH | capa/features/extractors/binja/insn.py | 0 | parse referenced byte sequences example: push offset iid_004118d4_ishelllinka ; riid | STRING |
| HIGH | capa/features/extractors/ghidra/insn.py | 0 | parse referenced byte sequences example: push offset iid_004118d4_ishelllinka ; riid | STRING |
| HIGH | capa/features/extractors/ida/insn.py | 0 | parse instruction string features example: push offset aacr ; "acr > " | STRING |
| HIGH | capa/features/extractors/binja/insn.py | 0 | parse instruction string features example: push offset aacr ; "acr > " | STRING |
| HIGH | capa/features/extractors/ghidra/insn.py | 0 | parse instruction string features example: push offset aacr ; "acr > " | STRING |
| HIGH | capa/features/extractors/ida/insn.py | 0 | parse instruction structure offset features example: .text:0040112f cmp [esi+4], ebx | STRING |
| HIGH | capa/features/extractors/binja/insn.py | 0 | parse instruction structure offset features example: .text:0040112f cmp [esi+4], ebx | STRING |
| HIGH | capa/features/extractors/ghidra/insn.py | 0 | parse instruction structure offset features example: .text:0040112f cmp [esi+4], ebx | STRING |
| HIGH | capa/features/extractors/ida/insn.py | 0 | inspect the instruction for a call or jmp that crosses section boundaries | STRING |
| HIGH | capa/features/extractors/binja/insn.py | 0 | inspect the instruction for a call or jmp that crosses section boundaries | STRING |
| HIGH | capa/features/extractors/ghidra/insn.py | 0 | inspect the instruction for a call or jmp that crosses section boundaries | STRING |
| HIGH | capa/features/extractors/ida/insn.py | 0 | extract functions calls from features most relevant at the function scope, however, its most efficient to extract at the | STRING |
| HIGH | capa/features/extractors/binja/insn.py | 0 | extract functions calls from features most relevant at the function scope, however, its most efficient to extract at the | STRING |
| HIGH | capa/features/extractors/ghidra/insn.py | 0 | extract functions calls from features most relevant at the function scope, however, its most efficient to extract at the | STRING |
| HIGH | capa/features/extractors/ida/insn.py | 0 | extract indirect function calls (e.g., call eax or call dword ptr [edx+4]) does not include calls like => call ds:dword_ | STRING |
| HIGH | capa/features/extractors/binja/insn.py | 0 | extract indirect function calls (e.g., call eax or call dword ptr [edx+4]) does not include calls like => call ds:dword_ | STRING |
| HIGH | capa/features/extractors/ghidra/insn.py | 0 | extract indirect function calls (e.g., call eax or call dword ptr [edx+4]) does not include calls like => call ds:dword_ | STRING |
| HIGH | tests/test_rule_cache.py | 0 | rule: meta: authors: - user@domain.com examples: - foo1234 - bar5678 scopes: static: function dynamic: process name: aaa | STRING |
| HIGH | tests/test_fmt.py | 0 | rule: meta: authors: - user@domain.com examples: - foo1234 - bar5678 scopes: static: function dynamic: process name: aaa | STRING |
| HIGH | tests/test_render.py | 0 | rule: meta: authors: - user@domain.com examples: - foo1234 - bar5678 scopes: static: function dynamic: process name: aaa | STRING |
| HIGH | tests/test_result_document.py | 0 | rule: meta: name: test rule no scopes scopes: static: function dynamic: process features: - api: createfile | STRING |
| HIGH | tests/test_rules.py | 0 | rule: meta: name: test rule no scopes scopes: static: function dynamic: process features: - api: createfile | STRING |
| HIGH | tests/test_scripts.py | 0 | rule: meta: name: test rule no scopes scopes: static: function dynamic: process features: - api: createfile | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .pre-commit-config.yaml | 1 | # install the pre-commit hooks: | COMMENT |
| LOW | pyproject.toml | 1 | # Copyright 2023 Google LLC | COMMENT |
| LOW | pyproject.toml | 41 | dependencies = [ | COMMENT |
| LOW | pyproject.toml | 61 | # | COMMENT |
| LOW | web/rules/scripts/build_rules.py | 1 | # Copyright 2024 Google LLC | COMMENT |
| LOW | web/rules/scripts/build_rules.py | 161 | logger.info("wrote: %s", html_path) | COMMENT |
| LOW | web/rules/scripts/modified-dates.py | 1 | # Copyright 2024 Google LLC | COMMENT |
| LOW | web/rules/scripts/build_root.py | 1 | # Copyright 2024 Google LLC | COMMENT |
| LOW | capa/perf.py | 1 | # Copyright 2021 Google LLC | COMMENT |
| LOW | capa/version.py | 1 | # Copyright 2020 Google LLC | COMMENT |
| LOW | capa/engine.py | 1 | # Copyright 2020 Google LLC | COMMENT |
| LOW | capa/engine.py | 261 | raise ValueError("cannot evaluate a subscope directly!") | COMMENT |
| LOW | capa/loader.py | 1 | # Copyright 2024 Google LLC | COMMENT |
| LOW | capa/optimizer.py | 1 | # Copyright 2021 Google LLC | COMMENT |
| LOW | capa/exceptions.py | 1 | # Copyright 2022 Google LLC | COMMENT |
| LOW | capa/main.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | capa/main.py | 441 | # from sys.stdout type hint: | COMMENT |
| LOW | capa/helpers.py | 1 | # Copyright 2020 Google LLC | COMMENT |
| LOW | capa/capabilities/dynamic.py | 1 | # Copyright 2023 Google LLC | COMMENT |
| LOW | capa/capabilities/dynamic.py | 81 | super().__init__() | COMMENT |
| LOW | capa/capabilities/common.py | 1 | # Copyright 2023 Google LLC | COMMENT |
| LOW | capa/capabilities/static.py | 1 | # Copyright 2023 Google LLC | COMMENT |
| LOW | capa/features/address.py | 1 | # Copyright 2022 Google LLC | COMMENT |
| LOW | capa/features/file.py | 1 | # Copyright 2020 Google LLC | COMMENT |
| LOW | capa/features/common.py | 1 | # Copyright 2021 Google LLC | COMMENT |
| LOW | capa/features/basicblock.py | 1 | # Copyright 2020 Google LLC | COMMENT |
| LOW | capa/features/insn.py | 1 | # Copyright 2020 Google LLC | COMMENT |
| LOW | capa/features/freeze/__init__.py | 1 | # Copyright 2022 Google LLC | COMMENT |
| LOW | capa/features/freeze/features.py | 1 | # Copyright 2022 Google LLC | COMMENT |
| LOW | capa/features/freeze/__main__.py | 1 | # Copyright 2026 Google LLC | COMMENT |
| LOW | capa/features/extractors/pefile.py | 1 | # Copyright 2021 Google LLC | COMMENT |
| LOW | capa/features/extractors/null.py | 1 | # Copyright 2022 Google LLC | COMMENT |
| LOW | capa/features/extractors/loops.py | 1 | # Copyright 2020 Google LLC | COMMENT |
| LOW | capa/features/extractors/base_extractor.py | 1 | # Copyright 2021 Google LLC | COMMENT |
| LOW | capa/features/extractors/common.py | 1 | # Copyright 2021 Google LLC | COMMENT |
| LOW | capa/features/extractors/elf.py | 1 | # Copyright 2021 Google LLC | COMMENT |
| LOW | capa/features/extractors/elf.py | 1141 | # | COMMENT |
| LOW | capa/features/extractors/elf.py | 1201 | # | COMMENT |
| LOW | capa/features/extractors/elf.py | 1301 | # - freebsd_amd64 | COMMENT |
| LOW | capa/features/extractors/elf.py | 1321 | # - linux_x86 | COMMENT |
| LOW | capa/features/extractors/elf.py | 1381 | # candidates today: | COMMENT |
| LOW | capa/features/extractors/elf.py | 1401 | # - linux_arm | COMMENT |
| LOW | capa/features/extractors/dotnetfile.py | 1 | # Copyright 2022 Google LLC | COMMENT |
| LOW | capa/features/extractors/helpers.py | 1 | # Copyright 2020 Google LLC | COMMENT |
| LOW | capa/features/extractors/strings.py | 1 | # strings code from FLOSS, https://github.com/mandiant/flare-floss | COMMENT |
| LOW | capa/features/extractors/elffile.py | 1 | # Copyright 2021 Google LLC | COMMENT |
| LOW | capa/features/extractors/viv/indirect_calls.py | 1 | # Copyright 2020 Google LLC | COMMENT |
| LOW | capa/features/extractors/viv/extractor.py | 1 | # Copyright 2021 Google LLC | COMMENT |
| LOW | capa/features/extractors/viv/file.py | 1 | # Copyright 2020 Google LLC | COMMENT |
| LOW | capa/features/extractors/viv/basicblock.py | 1 | # Copyright 2020 Google LLC | COMMENT |
| LOW | capa/features/extractors/viv/helpers.py | 1 | # Copyright 2020 Google LLC | COMMENT |
| LOW | capa/features/extractors/viv/global_.py | 1 | # Copyright 2021 Google LLC | COMMENT |
| LOW | capa/features/extractors/viv/function.py | 1 | # Copyright 2020 Google LLC | COMMENT |
| LOW | capa/features/extractors/viv/insn.py | 1 | # Copyright 2020 Google LLC | COMMENT |
| LOW | capa/features/extractors/viv/insn.py | 81 | if target in imports: | COMMENT |
| LOW | capa/features/extractors/dnfile/types.py | 1 | # Copyright 2022 Google LLC | COMMENT |
| LOW | capa/features/extractors/dnfile/extractor.py | 1 | # Copyright 2022 Google LLC | COMMENT |
| LOW | capa/features/extractors/dnfile/file.py | 1 | # Copyright 2022 Google LLC | COMMENT |
| LOW | capa/features/extractors/dnfile/helpers.py | 1 | # Copyright 2022 Google LLC | COMMENT |
| LOW | capa/features/extractors/dnfile/function.py | 1 | # Copyright 2022 Google LLC | COMMENT |
| 188 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | web/rules/scripts/build_root.py | 54 | CODE | |
| LOW | capa/loader.py | 184 | CODE | |
| LOW | capa/loader.py | 265 | CODE | |
| LOW | capa/loader.py | 513 | CODE | |
| LOW | capa/loader.py | 561 | CODE | |
| LOW | capa/loader.py | 677 | CODE | |
| LOW | capa/optimizer.py | 23 | CODE | |
| LOW | capa/main.py | 401 | CODE | |
| LOW | capa/main.py | 568 | CODE | |
| LOW | capa/main.py | 713 | CODE | |
| LOW | capa/main.py | 850 | CODE | |
| LOW | capa/main.py | 944 | CODE | |
| LOW | capa/helpers.py | 200 | CODE | |
| LOW | capa/helpers.py | 223 | CODE | |
| LOW | capa/capabilities/static.py | 151 | CODE | |
| LOW | capa/features/freeze/__init__.py | 72 | CODE | |
| LOW | capa/features/freeze/__init__.py | 106 | CODE | |
| LOW | capa/features/freeze/features.py | 113 | CODE | |
| LOW | capa/features/freeze/features.py | 28 | CODE | |
| LOW | capa/features/extractors/pefile.py | 36 | CODE | |
| LOW | capa/features/extractors/pefile.py | 63 | CODE | |
| LOW | capa/features/extractors/common.py | 67 | CODE | |
| LOW | capa/features/extractors/common.py | 90 | CODE | |
| LOW | capa/features/extractors/common.py | 125 | CODE | |
| LOW | capa/features/extractors/elf.py | 829 | CODE | |
| LOW | capa/features/extractors/elf.py | 873 | CODE | |
| LOW | capa/features/extractors/elf.py | 906 | CODE | |
| LOW | capa/features/extractors/elf.py | 962 | CODE | |
| LOW | capa/features/extractors/elf.py | 1541 | CODE | |
| LOW | capa/features/extractors/elf.py | 495 | CODE | |
| LOW | capa/features/extractors/elffile.py | 88 | CODE | |
| LOW | capa/features/extractors/elffile.py | 174 | CODE | |
| LOW | capa/features/extractors/viv/indirect_calls.py | 79 | CODE | |
| LOW | capa/features/extractors/viv/basicblock.py | 30 | CODE | |
| LOW | capa/features/extractors/viv/basicblock.py | 103 | CODE | |
| LOW | capa/features/extractors/viv/function.py | 29 | CODE | |
| LOW | capa/features/extractors/viv/function.py | 59 | CODE | |
| LOW | capa/features/extractors/viv/insn.py | 59 | CODE | |
| LOW | capa/features/extractors/viv/insn.py | 260 | CODE | |
| LOW | capa/features/extractors/viv/insn.py | 420 | CODE | |
| LOW | capa/features/extractors/viv/insn.py | 477 | CODE | |
| LOW | capa/features/extractors/viv/insn.py | 518 | CODE | |
| LOW | capa/features/extractors/viv/insn.py | 677 | CODE | |
| LOW | capa/features/extractors/dnfile/insn.py | 95 | CODE | |
| LOW | capa/features/extractors/drakvuf/models.py | 126 | CODE | |
| LOW | capa/features/extractors/ida/file.py | 107 | CODE | |
| LOW | capa/features/extractors/ida/basicblock.py | 31 | CODE | |
| LOW | capa/features/extractors/ida/helpers.py | 267 | CODE | |
| LOW | capa/features/extractors/ida/insn.py | 308 | CODE | |
| LOW | capa/features/extractors/binja/find_binja_api.py | 107 | CODE | |
| LOW | capa/features/extractors/binja/file.py | 57 | CODE | |
| LOW | capa/features/extractors/binja/file.py | 149 | CODE | |
| LOW | capa/features/extractors/binja/insn.py | 66 | CODE | |
| LOW | capa/features/extractors/binja/insn.py | 123 | CODE | |
| LOW | capa/features/extractors/binja/insn.py | 493 | CODE | |
| LOW | capa/features/extractors/binja/insn.py | 135 | CODE | |
| LOW | capa/features/extractors/binexport2/__init__.py | 62 | CODE | |
| LOW | capa/features/extractors/binexport2/extractor.py | 48 | CODE | |
| LOW | capa/features/extractors/binexport2/helpers.py | 202 | CODE | |
| LOW | capa/features/extractors/binexport2/helpers.py | 352 | CODE | |
| 82 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | web/rules/scripts/build_rules.py | 27 | logger = logging.getLogger(__name__) | CODE |
| LOW | web/rules/scripts/modified-dates.py | 22 | logger = logging.getLogger(__name__) | CODE |
| LOW | web/rules/scripts/build_root.py | 22 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/loader.py | 62 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/optimizer.py | 20 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/capabilities/dynamic.py | 30 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/capabilities/common.py | 35 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/capabilities/static.py | 30 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/common.py | 32 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/freeze/__init__.py | 39 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/pefile.py | 28 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/common.py | 47 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/elf.py | 26 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/dotnetfile.py | 58 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/elffile.py | 30 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/viv/extractor.py | 39 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/viv/global_.py | 21 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/dnfile/helpers.py | 33 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | capa/features/extractors/dnfile/function.py | 27 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/dnfile/insn.py | 41 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/drakvuf/thread.py | 23 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/drakvuf/models.py | 20 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/drakvuf/extractor.py | 36 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/drakvuf/file.py | 26 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/drakvuf/process.py | 24 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/drakvuf/call.py | 26 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/drakvuf/global_.py | 23 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/ida/idalib.py | 18 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/ida/global_.py | 26 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/binja/find_binja_api.py | 23 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/binja/global_.py | 23 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/binexport2/__init__.py | 41 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/binexport2/extractor.py | 44 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/binexport2/file.py | 29 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/binexport2/insn.py | 39 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/binexport2/arch/intel/insn.py | 33 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/binexport2/arch/arm/insn.py | 35 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/ghidra/global_.py | 25 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/vmray/__init__.py | 25 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/vmray/extractor.py | 41 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/vmray/file.py | 25 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/vmray/call.py | 26 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/vmray/global_.py | 36 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/cape/thread.py | 23 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/cape/extractor.py | 37 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/cape/file.py | 26 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/cape/process.py | 24 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/cape/call.py | 27 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/features/extractors/cape/global_.py | 35 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/render/vverbose.py | 36 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/ida/plugin/__init__.py | 22 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/ida/plugin/form.py | 53 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/ida/plugin/qt_compat.py | 79 | __all__ = ["qt_get_item_flag_tristate", "Signal", "QAction", "QtGui", "QtCore", "QtWidgets"] | CODE |
| LOW | capa/rules/cache.py | 28 | logger = logging.getLogger(__name__) | CODE |
| LOW | capa/rules/__init__.py | 50 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/test_extractor_hashing.py | 23 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/test_idalib_features.py | 23 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/test_binexport_accessors.py | 60 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/test_scripts.py | 28 | logger = logging.getLogger(__name__) | CODE |
| LOW | scripts/minimize_vmray_results.py | 29 | logger = logging.getLogger(__name__) | CODE |
| 1 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | web/rules/scripts/build_root.py | 259 | except Exception as e: | STRING |
| LOW | web/rules/scripts/build_root.py | 341 | except Exception as e: | CODE |
| LOW | capa/loader.py | 145 | except Exception: | CODE |
| LOW | capa/loader.py | 154 | except Exception: | CODE |
| LOW | capa/loader.py | 231 | except Exception as e: | CODE |
| LOW | capa/loader.py | 480 | except Exception: | CODE |
| LOW⚡ | capa/features/extractors/elf.py | 1547 | except Exception as e: | CODE |
| LOW⚡ | capa/features/extractors/elf.py | 1554 | except Exception as e: | CODE |
| LOW⚡ | capa/features/extractors/elf.py | 1561 | except Exception as e: | CODE |
| LOW⚡ | capa/features/extractors/elf.py | 1568 | except Exception as e: | CODE |
| LOW⚡ | capa/features/extractors/elf.py | 1575 | except Exception as e: | CODE |
| LOW⚡ | capa/features/extractors/elf.py | 1582 | except Exception as e: | CODE |
| LOW⚡ | capa/features/extractors/elf.py | 1589 | except Exception as e: | CODE |
| LOW⚡ | capa/features/extractors/elf.py | 1596 | except Exception as e: | CODE |
| LOW⚡ | capa/features/extractors/elf.py | 1603 | except Exception as e: | CODE |
| LOW⚡ | capa/features/extractors/elf.py | 1610 | except Exception as e: | CODE |
| LOW⚡ | capa/features/extractors/elf.py | 1617 | except Exception as e: | CODE |
| LOW⚡ | capa/features/extractors/elf.py | 1624 | except Exception as e: | CODE |
| LOW | capa/features/extractors/elf.py | 819 | except Exception: | CODE |
| LOW | capa/features/extractors/viv/function.py | 38 | except Exception: | CODE |
| LOW | capa/features/extractors/viv/insn.py | 112 | except Exception: | CODE |
| LOW | capa/features/extractors/viv/insn.py | 205 | except Exception: | CODE |
| LOW | capa/features/extractors/binja/helpers.py | 68 | except Exception: | CODE |
| LOW | capa/features/extractors/ghidra/helpers.py | 87 | except Exception: | CODE |
| MEDIUM | capa/ida/plugin/form.py | 570 | def ensure_capa_settings_rule_path(self): | CODE |
| LOW⚡ | capa/ida/plugin/form.py | 712 | except Exception as e: | CODE |
| LOW⚡ | capa/ida/plugin/form.py | 729 | except Exception as e: | CODE |
| LOW | capa/ida/plugin/form.py | 610 | except Exception as e: | CODE |
| LOW | capa/ida/plugin/form.py | 638 | except Exception as e: | CODE |
| LOW | capa/ida/plugin/form.py | 741 | except Exception as e: | CODE |
| LOW | capa/ida/plugin/form.py | 779 | except Exception as e: | CODE |
| LOW | capa/ida/plugin/form.py | 813 | except Exception as e: | CODE |
| LOW | capa/ida/plugin/form.py | 827 | except Exception as e: | CODE |
| LOW | capa/ida/plugin/form.py | 843 | except Exception as e: | CODE |
| LOW | capa/ida/plugin/form.py | 864 | except Exception as e: | CODE |
| LOW | capa/ida/plugin/form.py | 915 | except Exception as e: | CODE |
| LOW | capa/ida/plugin/form.py | 935 | except Exception as e: | CODE |
| LOW | capa/ida/plugin/form.py | 989 | except Exception as e: | CODE |
| LOW | capa/ida/plugin/form.py | 1007 | except Exception as e: | CODE |
| LOW | capa/ida/plugin/form.py | 1034 | except Exception as e: | CODE |
| LOW | capa/ida/plugin/form.py | 1055 | except Exception as e: | CODE |
| LOW | capa/ida/plugin/form.py | 1076 | except Exception as e: | CODE |
| LOW | capa/ida/plugin/form.py | 1161 | except Exception as e: | CODE |
| LOW | capa/ida/plugin/form.py | 1175 | except Exception as e: | CODE |
| LOW | capa/ida/plugin/form.py | 1188 | except Exception as e: | CODE |
| LOW | capa/ida/plugin/form.py | 1205 | except Exception as e: | CODE |
| LOW | capa/ida/plugin/form.py | 1218 | except Exception as e: | CODE |
| MEDIUM | capa/rules/__init__.py | 1215 | def _get_yaml_loader(): | CODE |
| LOW | capa/rules/__init__.py | 1222 | except Exception: | CODE |
| LOW | scripts/detect_duplicate_features.py | 40 | except Exception as e: | CODE |
| LOW | scripts/bulk-process.py | 135 | except Exception as e: | CODE |
| LOW | scripts/capa2yara.py | 164 | except Exception: | STRING |
| LOW | scripts/capa2yara.py | 367 | except Exception: | STRING |
| LOW | scripts/capa2yara.py | 376 | except Exception: | STRING |
| MEDIUM | scripts/capa2yara.py | 157 | def convert_description(statement): | CODE |
| LOW | scripts/lint.py | 442 | except Exception as e: | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | pyproject.toml | 42 | # --------------------------------------- | COMMENT |
| MEDIUM | pyproject.toml | 68 | # --------------------------------------- | COMMENT |
| MEDIUM | pyproject.toml | 89 | # --------------------------------------- | COMMENT |
| MEDIUM | pyproject.toml | 99 | # --------------------------------------- | COMMENT |
| MEDIUM | capa/features/extractors/cape/models.py | 420 | # ========================================================================= | COMMENT |
| MEDIUM | capa/rules/__init__.py | 1716 | # ----------------------------------------------------------------- | COMMENT |
| MEDIUM | capa/rules/__init__.py | 1726 | # ----------------------------------------------------------------- | COMMENT |
| MEDIUM | capa/rules/__init__.py | 1738 | # ----------------------------------------------------------------- | COMMENT |
| MEDIUM | capa/rules/__init__.py | 1747 | # ----------------------------------------------------------------- | COMMENT |
| MEDIUM | capa/rules/__init__.py | 1761 | # ----------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_match_fixtures.py | 678 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_match_fixtures.py | 680 | # --------------------------------------------------------------------------- | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | capa/features/extractors/ghidra/file.py | 156 | fstr = f.toString().split("::") # format: MODULE.dll::import / MODULE::Ordinal_* | CODE |
| HIGH | capa/features/extractors/ghidra/helpers.py | 133 | fstr = f.toString().split("::") # format: MODULE.dll::import / MODULE::Ordinal_* / <EXTERNAL>::import | CODE |
| HIGH⚡ | capa/features/extractors/ghidra/insn.py | 101 | # If it returned null, it was an indirect | COMMENT |
| HIGH⚡ | capa/features/extractors/ghidra/insn.py | 357 | # If it returned null, it was an indirect | COMMENT |
| HIGH⚡ | capa/features/extractors/ghidra/insn.py | 293 | insn_str = insn.toString() | CODE |
| HIGH⚡ | capa/features/extractors/ghidra/insn.py | 312 | insn_str = insn.toString() | CODE |
| HIGH | capa/ida/plugin/proxy.py | 59 | otherwise return false | STRING |
| HIGH | tests/test_binja_features.py | 72 | version = binaryninja.core_version_info() # type: ignore[possibly-undefined] # guarded by skipif binja_present | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | capa/features/extractors/viv/insn.py | 310 | except envi.exc.SegmentationViolation: | CODE |
| HIGH | capa/features/extractors/viv/insn.py | 323 | except envi.exc.SegmentationViolation: | CODE |
| HIGH | capa/features/extractors/viv/insn.py | 325 | except IndexError: | CODE |
| HIGH | capa/features/extractors/ida/helpers.py | 262 | except UnicodeDecodeError: | CODE |
| HIGH | tests/test_extractor_hashing.py | 88 | except ImportError: | CODE |
| HIGH | tests/test_binja_features.py | 36 | except ImportError: | CODE |
| HIGH | scripts/capa2yara.py | 164 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | capa/helpers.py | 32 | CODE | |
| LOW | capa/features/extractors/elf.py | 24 | CODE | |
| LOW | capa/features/extractors/dnfile/extractor.py | 16 | CODE | |
| LOW | capa/features/extractors/dnfile/file.py | 16 | CODE | |
| LOW | capa/features/extractors/dnfile/helpers.py | 16 | CODE | |
| LOW | capa/features/extractors/dnfile/function.py | 16 | CODE | |
| LOW | capa/features/extractors/dnfile/insn.py | 16 | CODE | |
| LOW | capa/features/extractors/binja/find_binja_api.py | 168 | CODE | |
| LOW | capa/features/extractors/binja/find_binja_api.py | 178 | CODE | |
| LOW | capa/features/extractors/ghidra/helpers.py | 17 | CODE | |
| LOW | capa/ida/plugin/cache.py | 16 | CODE | |
| LOW | capa/ida/plugin/qt_compat.py | 25 | CODE | |
| LOW | capa/ida/plugin/qt_compat.py | 25 | CODE | |
| LOW | capa/ida/plugin/qt_compat.py | 26 | CODE | |
| LOW | capa/ida/plugin/qt_compat.py | 33 | CODE | |
| LOW | capa/ida/plugin/qt_compat.py | 33 | CODE | |
| LOW | capa/ida/plugin/qt_compat.py | 34 | CODE | |
| LOW | tests/conftest.py | 23 | CODE | |
| LOW | tests/test_feature_snapshots.py | 38 | CODE | |
| LOW | tests/test_feature_snapshots.py | 231 | CODE | |
| LOW | tests/test_idalib_features.py | 32 | CODE | |
| LOW | tests/test_match_fixtures.py | 15 | CODE | |
| LOW | scripts/detect-backends.py | 40 | CODE | |
| LOW | scripts/detect-backends.py | 108 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | capa/features/extractors/base_extractor.py | 206 | fetch any recognized name for the given address. this is only guaranteed to return a value when the giv | STRING |
| HIGH | capa/features/extractors/viv/indirect_calls.py | 80 | scan backwards from the given address looking for assignments to the given register. if a constant, return that | STRING |
| HIGH | capa/features/extractors/viv/indirect_calls.py | 148 | inspect the given indirect call instruction and attempt to resolve the target address. args: vw (vivisec | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | capa/features/extractors/viv/indirect_calls.py | 122 | # this is a good place to extend in the future, if we need more robust support. | COMMENT |
| MEDIUM | capa/features/extractors/ida/helpers.py | 428 | # leverage idaapi.FC_NOEXT flag to ignore useless external blocks referenced by the function | COMMENT |
| MEDIUM | capa/features/extractors/ghidra/insn.py | 383 | # is not as robust as methods in other functions, | COMMENT |
| MEDIUM | capa/ida/plugin/hooks.py | 21 | """facilitate IDA UI hooks | STRING |
| LOW | capa/ida/plugin/view.py | 41 | # blank line, which may occur for comments so we simply use the last level | COMMENT |
| LOW | capa/ghidra/plugin/capa_explorer.py | 255 | # in many cases, these will be ghidra-labeled data, so just add the existing | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | capa/helpers.py | 141 | # Create a new sys.stdout that points to the redirected fd | COMMENT |
| MEDIUM | scripts/capa2sarif.py | 183 | # Create a SARIF Log object, populate with a single run | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | capa/features/extractors/base_extractor.py | 35 | # you can use the `.address` property to get and render the address of the feature. | COMMENT |
| LOW | capa/rules/__init__.py | 1218 | # on Linux, make sure you install libyaml-dev or similar | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_elffile_features.py | 39 | # Check if all expected symbol names are found | COMMENT |
| LOW⚡ | tests/test_elffile_features.py | 56 | # Check if all expected symbol names are found | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/detect_duplicate_features.py | 69 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/capa2sarif.py | 118 | sarif_structure["runs"][0]["artifacts"][0]["description"] = {"text": "placeholder"} | CODE |