Metadata-Version: 2.3
Name: CAPEsolo
Version: 0.5.26
Summary: Standalone CAPEMON
Author: enzok
Author-email: enzok <<7831008+enzok@users.noreply.github.com>>
Requires-Dist: wxpython>=4.3.0
Requires-Dist: pywin32>=312
Requires-Dist: yara-python>=4.5.4
Requires-Dist: pefile>=2024.8.26
Requires-Dist: cryptography>=49.0.0
Requires-Dist: requests>=2.33.0
Requires-Dist: sflock2>=0.3.87
Requires-Dist: greenlet>=3.5.4
Requires-Dist: gevent>=26.7.0
Requires-Dist: dnspython>=2.8.0
Requires-Dist: tldextract>=5.3.1
Requires-Dist: bs2json>=0.3.0
Requires-Dist: cape-parsers>=0.1.64
Requires-Dist: pytest>=9.0.3
Requires-Dist: setuptools>=83.0.0
Requires-Dist: typing-extensions==4.16.0
Requires-Dist: ruff>=0.16.0
Requires-Dist: poetry-core>=2.4.1
Requires-Dist: distorm3s==3.5.5
Requires-Dist: keystone-engine>=0.9.2
Requires-Dist: jinja2>=3.1.6
Requires-Dist: pymongo>=4.17.0
Requires-Dist: tlsh-python>=0.1.0
Requires-Dist: mcp>=2.0.0
Requires-Python: >=3.10, <3.14
Description-Content-Type: text/markdown

Python GUI to run capemon in standalone VM. Provides a subset of CAPE (Configuration And Payload Extraction) processing and results.

* Create a Windows 10 VM that's suitable for running malware.
  * Use the CAPEv2 guest guide for configuration details.
  * https://capev2.readthedocs.io/en/latest/installation/guest/index.html
* Install Python in VM, tested on 64-bit Python versions 3.11 and 3.12, and add Python to path.
* Download and install both Microsoft Visual C++ Redistributables:
  * https://aka.ms/vs/17/release/vc_redist.x86.exe
  * https://aka.ms/vs/17/release/vc_redist.x64.exe
* Install CAPEsolo.
  * pip install CAPEsolo
* Snapshot your VM.

Quick Start 
* Open an administrator command window.
* Type capesolo <return> to run.

Alternatively, create a shortcut to CAPEsolo.exe, 
which will be in the Scripts subdirectory of same location as your python.exe file. 
* Under Advanced, check 'Run as administrator'
* An icon file is available in the CAPEsolo install folder under site-packages.

Analysis results are found in C:\Users\Public\CAPEsolo\analysis.
* Can be configured in C:\Users\Public\CAPEsolo\cfg.ini
* Settings there override the packaged defaults in python-path\site-packages\CAPEsolo\cfg.ini,
  and survive `pip install --upgrade CAPEsolo`, which overwrites the packaged copy.
* Only include the keys you want to change; the rest fall back to the packaged defaults.

GUI theme
* Dark by default. For light, add to C:\Users\Public\CAPEsolo\cfg.ini and restart CAPEsolo:
```ini
[gui]
theme = light
```

Revert the VM after each analysis.

MCP Server
* CAPEsolo includes an MCP server entrypoint for programmatic analysis workflows.
* Start it over stdio with `CAPEsolo-mcp`, or serve it over HTTP to reach it from the host.
* See mcp_server.md for transports, `cfg.ini` configuration, the full tool list, and examples.

Interactive Debugger
* See interactive_debugger.md for the GUI debugger, and mcp_server.md for the MCP equivalent.

Headless Single-Run CLI
* CAPEsolo supports a non-MCP single-run mode that reuses the same backend job runner as the MCP server.
* Run one analysis and exit:
  * `CAPEsolo --headless-analyze "C:\path\sample.exe"`
* Optional flags:
  * `--package <name>`
  * `--options "key=value,key2=value2"`
  * `--timeout <seconds>`
  * `--enforce-timeout`
  * `--headless-json`
  * `--headless-html-report`
