Repository: mandiant/capa
File: capa/rules/__init__.py (Python)

Code before:

    com_features: List = []
    for guid_string in guid_strings:
        hex_chars = guid_string.replace("-", "")
        h = [hex_chars[i : i + 2] for i in range(0, len(hex_chars), 2)]
        reordered_hex_pairs = [
            h[3],
            h[2],
            h[1],
            h[0],
            h[5],
            h[4],
            h[7],
            h[6],
            h[8],
            h[9],
            h[10],
            h[11],
            h[12],
            h[13],
            h[14],
            h[15],
        ]
        guid_bytes = bytes.fromhex("".join(reordered_hex_pairs))
        prefix = VALID_COM_TYPES[com_type]["prefix"]
        com_features.append(capa.features.common.StringFactory(guid_string, f"{prefix+com_name} as guid string"))
        com_features.append(capa.features.common.Bytes(guid_bytes, f"{prefix+com_name} as bytes"))
    return ceng.Or(com_features)


def ensure_feature_valid_for_scope(scope: str, feature: Union[Feature, Statement]):
    # if the given feature is a characteristic,
    # check that is a valid characteristic for the given scope.
    if (
        isinstance(feature, capa.features.common.Characteristic)
        and isinstance(feature.value, str)
        and capa.features.common.Characteristic(feature.value) not in SUPPORTED_FEATURES[scope]
    ):
        raise InvalidRule(f"feature {feature} not supported for scope {scope}")

    if not isinstance(feature, capa.features.common.Characteristic):
        # features of this scope that are not Characteristics will be Type instances.
        # check that the given feature is one of these types.
        types_for_scope = filter(lambda t: isinstance(t, type), SUPPORTED_FEATURES[scope])
        if not isinstance(feature, tuple(types_for_scope)):  # type: ignore
            raise InvalidRule(f"feature {feature} not supported for scope {scope}")


def parse_int(s: str) -> int:
    if s.startswith("0x"):
        return int(s, 0x10)

Review comment (suggestion):
```suggestion
        com_features.append(capa.features.common.StringFactory(guid_string, f"{prefix+com_name} as GUID string"))
```

Code after:
        raise IOError(f"Error loading COM database from '{com_db_path}'") from e


def translate_com_feature(com_name: str, com_type: ComType) -> ceng.Or:
    com_db = load_com_database(com_type)
    guid_strings: Optional[List[str]] = com_db.get(com_name)
    if guid_strings is None or len(guid_strings) == 0:
        logger.error(" %s doesn't exist in COM %s database", com_name, com_type)
        raise InvalidRule(f"'{com_name}' doesn't exist in COM {com_type} database")

    com_features: List = []
    for guid_string in guid_strings:
        hex_chars = guid_string.replace("-", "")
        h = [hex_chars[i : i + 2] for i in range(0, len(hex_chars), 2)]
        reordered_hex_pairs = [
            h[3],
            h[2],
            h[1],
            h[0],
            h[5],
            h[4],
            h[7],
            h[6],
            h[8],
            h[9],
            h[10],
            h[11],
            h[12],
            h[13],
            h[14],
            h[15],
        ]
        guid_bytes = bytes.fromhex("".join(reordered_hex_pairs))
        prefix = VALID_COM_TYPES[com_type]["prefix"]
        com_features.append(capa.features.common.StringFactory(guid_string, f"{prefix+com_name} as GUID string"))
        com_features.append(capa.features.common.Bytes(guid_bytes, f"{prefix+com_name} as bytes"))
    return ceng.Or(com_features)


def ensure_feature_valid_for_scope(scope: str, feature: Union[Feature, Statement]):
    # if the given feature is a characteristic,
    # check that is a valid characteristic for the given scope.
    if (
        isinstance(feature, capa.features.common.Characteristic)
        and isinstance(feature.value, str)
        and capa.features.common.Characteristic(feature.value) not in SUPPORTED_FEATURES[scope]
    ):
        raise InvalidRule(f"feature {feature} not supported for scope {scope}")

    if not isinstance(feature, capa.features.common.Characteristic):
        # features of this scope that are not Characteristics will be Type instances.