display analysis information to users

CHANGELOG.md

@@ -8,6 +8,7 @@
 - add function in capa/helpers to load plain and compressed JSON reports #1883 @Rohit1123
 - document Antivirus warnings and VirusTotal false positive detections #2028 @RionEV @mr-tz
 - replace Halo spinner with Rich #2086 @s-ff
+- display analysis information for user #857 @s-ff
 
 ### Breaking Changes
 

capa/capabilities/common.py

@@ -52,8 +52,7 @@ def has_file_limitation(rules: RuleSet, capabilities: MatchResults, is_standalon
             logger.warning(" %s", line)
         logger.warning(" Identified via rule: %s", file_limitation_rule.name)
         if is_standalone:
-            logger.warning(" ")
-            logger.warning(" Use -v or -vv if you really want to see the capabilities identified by capa.")
+            pass
         logger.warning("-" * 80)
 
         # bail on first file limitation

capa/capabilities/static.py

@@ -21,6 +21,7 @@
 from capa.rules import Scope, RuleSet
 from capa.engine import FeatureSet, MatchResults
 from capa.helpers import redirecting_print_to_tqdm
+from capa.features.insn import API
 from capa.capabilities.common import find_file_capabilities
 from capa.features.extractors.base_extractor import BBHandle, InsnHandle, FunctionHandle, StaticFeatureExtractor
 
@@ -118,6 +119,9 @@ def find_code_capabilities(
         features, bmatches, imatches = find_basic_block_capabilities(ruleset, extractor, fh, bb)
         for feature, vas in features.items():
             function_features[feature].update(vas)
+            if isinstance(feature, API):
+                # delcare a global variable (a set) and append to it here?
+                pass
 
         for rule_name, res in bmatches.items():
             bb_matches[rule_name].extend(res)

capa/main.py

@@ -75,7 +75,7 @@
     FORMAT_RESULT,
 )
 from capa.capabilities.common import find_capabilities, has_file_limitation, find_file_capabilities
-from capa.features.extractors.base_extractor import FeatureExtractor, StaticFeatureExtractor, DynamicFeatureExtractor
+from capa.features.extractors.base_extractor import FeatureExtractor, DynamicFeatureExtractor
 
 RULES_PATH_DEFAULT_STRING = "(embedded rules)"
 SIGNATURES_PATH_DEFAULT_STRING = "(embedded signatures)"
@@ -666,16 +666,9 @@ def find_file_limitations_from_cli(args, rules: RuleSet, file_extractors: List[F
         except (ELFError, OverflowError) as e:
             logger.error("Input file '%s' is not a valid ELF file: %s", args.input_file, str(e))
             raise ShouldExitError(E_CORRUPT_FILE) from e
-
         # file limitations that rely on non-file scope won't be detected here.
         # nor on FunctionName features, because pefile doesn't support this.
         found_file_limitation = has_file_limitation(rules, pure_file_capabilities)
-        if found_file_limitation:
-            # bail if capa encountered file limitation e.g. a packed binary
-            # do show the output in verbose mode, though.
-            if not (args.verbose or args.vverbose or args.json):
-                logger.debug("file limitation short circuit, won't analyze fully.")
-                raise ShouldExitError(E_FILE_LIMITATION)
     return found_file_limitation
 
 
@@ -804,7 +797,7 @@ def main(argv: Optional[List[str]] = None):
         input_format = get_input_format_from_cli(args)
         rules = get_rules_from_cli(args)
         file_extractors = get_file_extractors_from_cli(args, input_format)
-        found_file_limitation = find_file_limitations_from_cli(args, rules, file_extractors)
+        _ = find_file_limitations_from_cli(args, rules, file_extractors)
     except ShouldExitError as e:
         return e.status_code
 
@@ -837,12 +830,6 @@ def main(argv: Optional[List[str]] = None):
         meta = capa.loader.collect_metadata(argv, args.input_file, input_format, os_, args.rules, extractor, counts)
         meta.analysis.layout = capa.loader.compute_layout(rules, extractor, capabilities)
 
-        if isinstance(extractor, StaticFeatureExtractor) and found_file_limitation:
-            # bail if capa's static feature extractor encountered file limitation e.g. a packed binary
-            # do show the output in verbose mode, though.
-            if not (args.verbose or args.vverbose or args.json):
-                return E_FILE_LIMITATION
-
     if args.json:
         print(capa.render.json.render(meta, rules, capabilities))
     elif args.vverbose:

capa/render/default.py

@@ -18,6 +18,7 @@
 from capa.render.utils import StringIO
 
 tabulate.PRESERVE_WHITESPACE = True
+MIN_LIBFUNCS_COUNT = 5
 
 
 def width(s: str, character_count: int) -> str:
@@ -29,6 +30,15 @@ def width(s: str, character_count: int) -> str:
 
 
 def render_meta(doc: rd.ResultDocument, ostream: StringIO):
+    # check if analysis is Static analysis to inform users about
+    # potential false postive due to low number of library functions
+    if isinstance(doc.meta.analysis, rd.StaticAnalysis):
+        n_libs: int = len(doc.meta.analysis.library_functions)
+        if n_libs <= MIN_LIBFUNCS_COUNT:
+            ostream.write(
+                "Few library functions recognized by FLIRT signatures, results may contain false positives\n\n"
+            )
+
     rows = [
         (width("md5", 22), width(doc.meta.sample.md5, 82)),
         ("sha1", doc.meta.sample.sha1),