mandiant / mandiant/capa

C# code to features

Open
#1,135 2 comments 0 reactions 0 assignees View on GitHub
dotnet question
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

Most analysts will read decompiled C# code. Can we A) create an utility to parse code segments to features (e.g. using capa-scripts portions) or B) even better allow to include verbatim C# code in rules?

## A)
Given a code line
```c#
HttpWebRequest r = System.Net.WebRequest.Create()
r.Method = "Get";
```
We extract the respective features.
*EDIT: This would be a separate script (or show-features) used as part of rule writing.*

## B)
```yaml
- features:
- code: >
HttpWebRequest r = System.Net.WebRequest.Create()
r.Method = "Get";
```

Would this be worth the effort?

### Ref
Idea came to me from here:

Ok, I'm having trouble following this. Can you include a comment of an example code snippet?

_Originally posted by @mr-tz in https://github.com/mandiant/capa-rules/pull/601#discussion_r942190106_

Contributor guide

Open the contributing guide

Research direction

The proposal centers on a separate show-features or capa-scripts workflow, or verbatim code entries in YAML rules; start by locating those entry points and the existing rule-writing flow. Done means one approach is selected and supports the example C# snippet, with its extracted features or matching behavior demonstrated.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp, python, yaml
Domain
reverse-engineering
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.