{
  "added_at": "2026-10-20",
  "additional_evidence_urls": [
    "https://github.com/mandiant/capa/blob/7a235c46965ea0965c65be3b9ee1e21dca686f3d/README.md#L153-L160",
    "https://github.com/mandiant/capa/blob/7a235c46965ea0965c65be3b9ee1e21dca686f3d/doc/installation.md",
    "https://github.com/mandiant/capa/blob/7a235c46965ea0965c65be3b9ee1e21dca686f3d/doc/usage.md",
    "https://github.com/mandiant/capa/blob/7a235c46965ea0965c65be3b9ee1e21dca686f3d/doc/limitations.md",
    "https://github.com/mandiant/capa/blob/7a235c46965ea0965c65be3b9ee1e21dca686f3d/capa/loader.py#L65-L75",
    "https://github.com/mandiant/capa/blob/7a235c46965ea0965c65be3b9ee1e21dca686f3d/capa/ida/plugin/README.md#L97-L110",
    "https://github.com/mandiant/capa/blob/7a235c46965ea0965c65be3b9ee1e21dca686f3d/capa/ghidra/README.md",
    "https://github.com/mandiant/capa/blob/7a235c46965ea0965c65be3b9ee1e21dca686f3d/pyproject.toml",
    "https://github.com/mandiant/capa/blob/7a235c46965ea0965c65be3b9ee1e21dca686f3d/LICENSE.txt",
    "https://github.com/mandiant/capa/releases/tag/v10.0.0",
    "https://pypi.org/project/flare-capa/10.0.0/"
  ],
  "category": "native-analysis",
  "description_en": "Mandiant FLARE tool that reports what an executable can do by matching a YAML rule set against features extracted from PE, ELF and .NET files or 32/64-bit shellcode, such as API calls, imports, strings and constants. Matches are grouped into capability namespaces with ATT&CK and MBC tags, and verbose output shows the function or basic-block addresses and features behind each match, pointing analysts to code worth studying. It also reads CAPE, DRAKVUF and VMRay sandbox reports for dynamic features and can use vivisect, IDA Pro, Ghidra or Binary Ninja for analysis, with explorer plugins for IDA and Ghidra and a browser viewer for its JSON results.",
  "description_zh": "Mandiant FLARE 团队的工具，将 YAML 规则集与从 PE、ELF、.NET 文件或 32/64 位 shellcode 中提取的 API 调用、导入、字符串和常量等特征进行匹配，报告可执行文件具备哪些功能。匹配结果按功能命名空间归类并标注 ATT&CK 和 MBC，详细输出会列出每项匹配所依据的函数或基本块地址及特征，为分析人员指出值得深入研究的代码。它还能读取 CAPE、DRAKVUF 和 VMRay 沙箱报告以利用动态特征，可选用 vivisect、IDA Pro、Ghidra 或 Binary Ninja 进行分析，并提供 IDA 和 Ghidra 的 explorer 插件以及查看 JSON 结果的浏览器界面。",
  "entry_url": "https://awesomerea.org/resources/capa/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/capa/",
  "evidence_url": "https://github.com/mandiant/capa/blob/7a235c46965ea0965c65be3b9ee1e21dca686f3d/README.md",
  "group": "tools",
  "id": "capa",
  "json_url": "https://awesomerea.org/resources/capa/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/capa/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/capa/index.md",
  "name": "capa",
  "name_zh": "capa 可执行文件功能识别工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Release at review: v10.0.0, published 2026-10-16, with standalone PyInstaller builds for Linux (x86_64, arm64 and a Python 3.13 variant), macOS (x86_64 and arm64) and Windows that run without installation; the reviewed master commit only syncs the rules submodule after that tag. The installation guide says the Linux build needs GLIBC 2.26+ and that macOS Gatekeeper must approve the binary on first run. The flare-capa PyPI package (10.0.0, Python 3.10+) does not include the default rules or library-identification signatures, which are passed with -r and -s.",
    "Inputs are user-supplied PE, ELF or .NET modules, raw shellcode, CAPE, DRAKVUF or VMRay reports, BinExport2 files or saved capa feature files. The IDA Pro explorer needs IDA 7.4+ with Python 3.10+ (tested through IDA 9.0); the Ghidra backend and explorer script need Ghidra 12.0+ started through PyGhidra; the Binary Ninja backend uses a separately installed Binary Ninja.",
    "The limitations guide states that packed or obfuscated programs, installers and packaged programs such as AutoIt give misleading or incomplete results, and that capabilities split across wrapper or child functions are not matched; capa warns when its rules detect packing or installers. Matches are rule-based indications of capability, not confirmed behavior.",
    "Apache-2.0, as is the separate capa-rules repository. v10.0.0 fixes code execution through crafted vivisect .viv workspace files, which affected v9.4.0 and earlier; existing workspaces now load only with CAPA_LOAD_VIV_WORKSPACE=1. A recursive source clone also fetches the test-file submodule, which the installation guide warns contains many malware samples."
  ],
  "requirements_zh": [
    "审阅时的版本为 v10.0.0，发布于 2026-10-16，提供用 PyInstaller 打包、无需安装即可运行的独立构建，涵盖 Linux（x86_64、arm64 及 Python 3.13 版本）、macOS（x86_64 和 arm64）和 Windows；所审阅的 master 分支提交在该标签之后仅同步了规则子模块。安装指南指出 Linux 构建需要 GLIBC 2.26+，macOS 首次运行时须在 Gatekeeper 中批准该程序。flare-capa PyPI 软件包（10.0.0，需 Python 3.10+）不含默认规则和库识别签名，需通过 -r 和 -s 参数指定。",
    "输入由使用者提供：PE、ELF 或 .NET 模块、原始 shellcode、CAPE、DRAKVUF 或 VMRay 报告、BinExport2 文件或已保存的 capa 特征文件。IDA Pro explorer 插件需要 IDA 7.4+ 和 Python 3.10+（已测试至 IDA 9.0）；Ghidra 后端和 explorer 脚本需要通过 PyGhidra 启动的 Ghidra 12.0+；Binary Ninja 后端需使用另行安装的 Binary Ninja。",
    "局限性文档指出，加壳或混淆的程序、安装程序以及 AutoIt 等打包程序会导致结果有误或不完整，分散在包装函数或子函数中的功能也无法匹配；当规则检测到加壳或安装程序时，capa 会发出警告。匹配结果是基于规则的功能迹象，并非已确认的行为。",
    "采用 Apache-2.0 许可，独立的 capa-rules 仓库同样如此。v10.0.0 修复了通过特制 vivisect .viv 工作区文件执行代码的问题，该问题影响 v9.4.0 及更早版本；现在仅在设置 CAPA_LOAD_VIV_WORKSPACE=1 时才会加载已有工作区。递归克隆源码还会拉取测试文件子模块，安装指南警告其中包含大量恶意软件样本。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/mandiant/capa",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}