Repository: mandiant/capa
File: capa/features/common.py (Python)

Code before:

        assert isinstance(self.value, bytes)
        for feature, locations in ctx.items():
            if not isinstance(feature, (Bytes,)):
                continue

            assert isinstance(feature.value, bytes)
            if feature.value.startswith(self.value):
                return Result(True, self, [], locations=locations)

        return Result(False, self, [])

    def get_value_str(self):
        assert isinstance(self.value, bytes)
        return hex_string(bytes_to_str(self.value))


# COM data source https://github.com/stevemk14ebr/COM-Code-Helper/tree/master
VALID_COM_TYPES = {"class": "assets/classes.pickle", "interface": "assets/interfaces.pickle"}


def get_guid_string_and_bytes(name: str, com_type: str):
    if com_type not in VALID_COM_TYPES:
        raise ValueError(f"unexpected COM feature type {com_type}")

    with Path(VALID_COM_TYPES[com_type]).open("rb") as pickle_file:
        com_data = pickle.load(pickle_file)
        guid_string = com_data.get(name)
        if guid_string is None:
            raise ValueError(f"{name} doesn't exist in COM {com_type} database")

    hex_chars = guid_string.replace("-", "")
    h = [hex_chars[i : i + 2] for i in range(0, len(hex_chars), 2)]
    reordered_hex_pairs = [
        h[3],
        h[2],
        h[1],
        h[0],
        h[5],
        h[4],
        h[7],
        h[6],
        h[8],
        h[9],
        h[10],
        h[11],
        h[12],
        h[13],
        h[14],
        h[15],
    ]

Review comment (suggestion):
please reference relative to a know path, like `__file__`, so that the traversal here is definitely not influenced by CWD/PWD.

Code after:
        for feature, locations in ctx.items():
            if not isinstance(feature, (Bytes,)):
                continue

            assert isinstance(feature.value, bytes)
            if feature.value.startswith(self.value):
                return Result(True, self, [], locations=locations)

        return Result(False, self, [])

    def get_value_str(self):
        assert isinstance(self.value, bytes)
        return hex_string(bytes_to_str(self.value))


# other candidates here: https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#machine-types
ARCH_I386 = "i386"
ARCH_AMD64 = "amd64"
# dotnet
ARCH_ANY = "any"
VALID_ARCH = (ARCH_I386, ARCH_AMD64, ARCH_ANY)


class Arch(Feature):
    def __init__(self, value: str, description=None):
        super().__init__(value, description=description)
        self.name = "arch"


OS_WINDOWS = "windows"
OS_LINUX = "linux"
OS_MACOS = "macos"
# dotnet
OS_ANY = "any"
VALID_OS = {os.value for os in capa.features.extractors.elf.OS}
VALID_OS.update({OS_WINDOWS, OS_LINUX, OS_MACOS, OS_ANY})
# internal only, not to be used in rules
OS_AUTO = "auto"


class OS(Feature):
    def __init__(self, value: str, description=None):
        super().__init__(value, description=description)
        self.name = "os"

    def evaluate(self, ctx, **kwargs):
        capa.perf.counters["evaluate.feature"] += 1
        capa.perf.counters["evaluate.feature." + self.name] += 1

        for feature, locations in ctx.items():
            if not isinstance(feature, (OS,)):