mandiant / mandiant/capa-rules
null-preserving XOR not identified
Open
Nobody has claimed this yet.
enhancement
- Dominant language
- No language data
- Stars
- 736
- Forks
- 245
- Avg merge
- 4d 53m
- Merged PRs (30d)
- 2
Description
capa doesn't detect null-preserving XOR because the XOR is not in a tight loop. Can we detect it?
Tested with capa 6.1.0 using sample 4ce210df92602f9cf4990357eb63f1f05cb5e89d03426a98a77ef98d6ff967bc
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the report with capa 6.1.0 and sample 4ce210df92602f9cf4990357eb63f1f05cb5e89d03426a98a77ef98d6ff967bc, then inspect the existing rules for null-preserving XOR behavior. Done means capa detects the null-preserving XOR when it is not in a tight loop, with a regression check covering the sample.
Written by the indexing model from the issue text.
Assessment
- Domain
- reverse-engineering
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 42/100