Capa-scripts: new feature - imported named constant

[adamstorek]

We might want to consider adding a new insn feature - a named constant - to capture the following examples:

win32con.FILE_ATTRIBUTE_HIDDEN
socket.SOCK_STREAM

These are captured by capa-binaries by using the Number feature and adding a description. This is, however, not applicable to source code, since programmers will often use/import named constants.

[mike-hunhoff]

Can we piggyback on the property feature for this?

[adamstorek]

I am slightly concerned about this solution, as this use case has to be handled differently than a property in the code. Whereas property belongs to some sort of a class/object, this socket.SOCK_STREAM is simply a SOCK_STREAM global variable from the socket module. Therefore, in the code we might need to potentially look even for a standalone SOCK_STREAM such as:

import socket
from socket import AF_INET, SOCK_STREAM

s = socket.socket(AF_INET, SOCK_STREAM)

Now that I think about it, it might be handled similarly to other APIs and perhaps should be handled as such. We might need to address APIs at some point in the future though, because at the moment it seems like already 4 distinct (and distinguishable) features - classes, static methods, regular methods, and global variables - are chucked under API (with 5th under way - creating com objects or using creator functions e.g. service = win32com.client.Dispatch("Schedule.Service") or wshell = WScript.CreateObject("WScript.Shell");.

[mr-tz]

We could try to extend numbers to match based on their value or their description. This would still require rule authors to identify and include relevant constants.

[mike-hunhoff]

We could exchange the number feature for a constant feature e.g.

rule:
  meta:
    name: create TCP socket
    ...
  features:
    - and:
      - or:
        - and: 
           - matches: compiled to native PE
           - constant: 1 = SOCK_STREAM
        - and:
           - matches: scripted Python
           - constant: socket.SOCK_STREAM
      ...