From 7be9f28a313eedff637c02f91a9b60d63be1b149 Mon Sep 17 00:00:00 2001 From: Michael Hunhoff Date: Thu, 7 Jul 2022 13:32:34 -0600 Subject: [PATCH 1/4] render: display number zero vverbose --- capa/render/vverbose.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/capa/render/vverbose.py b/capa/render/vverbose.py index b72504d90..ebf67042f 100644 --- a/capa/render/vverbose.py +++ b/capa/render/vverbose.py @@ -145,7 +145,7 @@ def render_feature(ostream, match: rd.Match, feature: frzf.Feature, indent=0): ostream.write(key) ostream.write(": ") - if value: + if value or key == "number": ostream.write(rutils.bold2(value)) if feature.description: From 319a31d48cb6a3843bc29cb1c9333ae7e76c7c47 Mon Sep 17 00:00:00 2001 From: Michael Hunhoff Date: Thu, 7 Jul 2022 13:36:25 -0600 Subject: [PATCH 2/4] update CHANGELOG --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8627bd2cb..ba03cff7b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -51,6 +51,7 @@ Deprecation notice: as described in [#937](https://github.com/mandiant/capa/issu ### Bug Fixes - improve handling _ prefix compile/link artifact #924 @mike-hunhoff - better detect OS in ELF samples #988 @williballenthin +- display number feature zero in vverbose #1097 @mike-hunhoff ### capa explorer IDA Pro plugin - improve file format extraction #918 @mike-hunhoff From 0443a51d62011811d526a000b08866b02de7161e Mon Sep 17 00:00:00 2001 From: Michael Hunhoff Date: Thu, 7 Jul 2022 15:31:59 -0600 Subject: [PATCH 3/4] display number features as hex vverbose --- capa/render/vverbose.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/capa/render/vverbose.py b/capa/render/vverbose.py index ebf67042f..86409f10b 100644 --- a/capa/render/vverbose.py +++ b/capa/render/vverbose.py @@ -142,10 +142,13 @@ def render_feature(ostream, match: rd.Match, feature: frzf.Feature, indent=0): if key == "string": value = render_string_value(value) + if key == "number": + value = hex(value) + ostream.write(key) ostream.write(": ") - if value or key == "number": + if value: ostream.write(rutils.bold2(value)) if feature.description: From 6e5ca493b750c56817f38e906b7989c165c4ad4e Mon Sep 17 00:00:00 2001 From: Michael Hunhoff Date: Fri, 8 Jul 2022 09:22:35 -0600 Subject: [PATCH 4/4] fix mypy --- capa/render/vverbose.py | 1 + 1 file changed, 1 insertion(+) diff --git a/capa/render/vverbose.py b/capa/render/vverbose.py index 86409f10b..679bbac5b 100644 --- a/capa/render/vverbose.py +++ b/capa/render/vverbose.py @@ -143,6 +143,7 @@ def render_feature(ostream, match: rd.Match, feature: frzf.Feature, indent=0): value = render_string_value(value) if key == "number": + assert isinstance(value, int) value = hex(value) ostream.write(key)