import-to-ida.py is not importing correctly

[lenz913]

Description

The current json output by capa seems to be different from what is expected by the script.

Steps to Reproduce

1. Generate json using capa.exe --json a.exe > a.json
2. Run import-to-ida.py to import a.json

Expected behavior:

Capa comments being applied on the sub functions.

Actual behavior:

Error in the python code on line 96 rule["matches"].keys() 'list' object has no attribute 'keys'

Versions

capa.exe 5.0.0 (standalone tool), Python version = 3.8.1, OS = Win10

Additional Information

Seems like currently it is expecting something like
for va in rule["matches"][0]: addr = va["value"]

[williballenthin]

i'm able to reproduce this

[williballenthin]

there's a fixed version here: https://github.com/mandiant/capa/blob/19a5ef8/scripts/import-to-ida.py
give it a shot and see if it works for the json reports you have locally.

we'll merge a fix for this issue on master, which will apply to v6 onwards.