mandiant / mandiant/capa

consider changing api feature name

Open
#1,130 0 comments 1 reaction 0 assignees View on GitHub
breaking-change question
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

As we extend capa to support more technologies/languages the feature name `api` may become confusing. For example, one could argue a class can be considered (or part of) an API blurring the distinction between the `class` and `api` features. Furthermore, it's difficult based on feature names alone to distinguish those that detect transfer of execution (`api`) from those that detect reference (`import`, `export`, `function-name`, `class`, `namespace`, etc.).

Changing the feature name `api` to `call` should help avoid confusion as `call` more clearly indicates the feature detects transfer of execution.

current:

```yaml
- api: kernel32.CreateMutex
- import: kernel32.CreateFile
```

proposed:

```yaml
- call: kernel32.CreateMutex
- import: kernel32.CreateFile
```

Alternatives to consider include `function-call`, `execute`, and `exec`:

```yaml
- function-call: kernel32.CreateMutex

- execute: kernel32.CreateMutex

- exec: kernel32.CreateMutex
```

Contributor guide

Open the contributing guide

Research direction

No files, tests, or entry points are identified in the issue. Start by locating all uses and documentation of the `api` feature, then assess the proposed names and any compatibility impact; done means an agreed feature name and a complete, consistent rename.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
reverse-engineering, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.