Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Feat/cleanup vverbose rendering #2567

Closed
wants to merge 15 commits into from
Closed

Feat/cleanup vverbose rendering #2567

wants to merge 15 commits into from

Conversation

williballenthin
Copy link
Collaborator

@williballenthin williballenthin commented Jan 20, 2025 •
edited
Loading

review after #2532

Screenshot 2025-01-20 6 07 22 PM

  • only show the call id within a span-of-calls match results, to reduce visual noise. can assume the ppid/pid/tid are the same as in the match header.
  • when there's only one call, use "call" not "calls" and don't show set decorations ("{}").

Checklist

  • No CHANGELOG update needed
  • No new tests needed
  • No documentation update needed

@williballenthin
rd: debugging helper formatting
1516c1c
@williballenthin
result: make copy of locations
1887a48 
to ensure its not modified by reference after we expect it to be
@williballenthin
capabilities: use dataclasses to represent complicated return types
dba0a6f 
foo
@williballenthin
dynamic: add sequence scope
59a5ea0 
addresses discussion in
mandiant/capa-rules#951

pep8

sequence: add test showing multiple sequences overlapping a single event
@williballenthin
sequence: only match first overlapping sequence
bd05680 
also, for repeating behavior, match only the first instance.
@williballenthin
sequence scope: optimize matching
7ecedd2
@williballenthin
sequence: documentation and tests
5ce3e72 
sequence: add more tests
@williballenthin
sequence: refactor into SequenceMatcher
2d45ff2 
contains the call ids for all the calls within the sequence, so we know
where to look for related matched.

sequence: refactor SequenceMatcher

sequence: don't use sequence addresses

sequence: remove sequence address
@williballenthin
sequence: better collect sequence-related addresses from Range statem…
02ead5b 
…ents
@williballenthin
sequence: don't update feature locations in place
d35fa96 
pep8
@williballenthin
changelog: add sequence scope
1ece45f
@williballenthin
rename "sequence" scope to "span of calls" scope
55e046e 
pep8

fix ref

update submodules

update testfiles submodule

duplicate variable
@williballenthin
vverbose: fix rendering of span-of-calls summaries
9c24e3a 
#2532 (comment)
@williballenthin
vverbose: don't use plural "calls" when there's a single call
f7fd5b7
@williballenthin
vverbose: don't render full ppid/pid/tid in nested blocks, only callid
aac2105
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@williballenthin