consider changing api feature name
- Dominant language
- Python
- Stars
- 6.2k
- Forks
- 726
- Avg merge
- 11d 11h
- Merged PRs (30d)
- 7
Description
As we extend capa to support more technologies/languages the feature name `api` may become confusing. For example, one could argue a class can be considered (or part of) an API blurring the distinction between the `class` and `api` features. Furthermore, it's difficult based on feature names alone to distinguish those that detect transfer of execution (`api`) from those that detect reference (`import`, `export`, `function-name`, `class`, `namespace`, etc.).
Changing the feature name `api` to `call` should help avoid confusion as `call` more clearly indicates the feature detects transfer of execution.
current:
```yaml
- api: kernel32.CreateMutex
- import: kernel32.CreateFile
```
proposed:
```yaml
- call: kernel32.CreateMutex
- import: kernel32.CreateFile
```
Alternatives to consider include `function-call`, `execute`, and `exec`:
```yaml
- function-call: kernel32.CreateMutex
- execute: kernel32.CreateMutex
- exec: kernel32.CreateMutex
```
Contributor guide
Research direction
No files, tests, or entry points are identified in the issue. Start by locating all uses and documentation of the `api` feature, then assess the proposed names and any compatibility impact; done means an agreed feature name and a complete, consistent rename.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- reverse-engineering, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100