C# code to features
- Dominant language
- Python
- Stars
- 6.2k
- Forks
- 726
- Avg merge
- 11d 11h
- Merged PRs (30d)
- 7
Description
Most analysts will read decompiled C# code. Can we A) create an utility to parse code segments to features (e.g. using capa-scripts portions) or B) even better allow to include verbatim C# code in rules?
## A)
Given a code line
```c#
HttpWebRequest r = System.Net.WebRequest.Create()
r.Method = "Get";
```
We extract the respective features.
*EDIT: This would be a separate script (or show-features) used as part of rule writing.*
## B)
```yaml
- features:
- code: >
HttpWebRequest r = System.Net.WebRequest.Create()
r.Method = "Get";
```
Would this be worth the effort?
### Ref
Idea came to me from here:
Ok, I'm having trouble following this. Can you include a comment of an example code snippet?
_Originally posted by @mr-tz in https://github.com/mandiant/capa-rules/pull/601#discussion_r942190106_
Contributor guide
Research direction
The proposal centers on a separate show-features or capa-scripts workflow, or verbatim code entries in YAML rules; start by locating those entry points and the existing rule-writing flow. Done means one approach is selected and supports the example C# snippet, with its extracted features or matching behavior demonstrated.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp, python, yaml
- Domain
- reverse-engineering
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100