mandiant / mandiant/capa

Potentially unreliable feature extraction on ELF sample

Open
#1,268 10 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

blocked-on-viv bug viv-bug
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

When running below rule on 294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc vivisect sometimes extract the `localtime` api feature and sometimes it doesn't. Is there a bug in the extractor, vivisect, or elsewhere?

```
rule:
meta:
name: get system time on Linux
namespace: host-interaction/os/info
authors:
- "@ramen0x3f"
scope: function
examples:
- 294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc:0x404970
features:
- and:
- os: linux
- or:
- api: localtime
```

ref: https://github.com/mandiant/capa-rules/pull/654

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the rule against the ELF sample identified by hash 294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc, checking whether the function at 0x404970 consistently yields the localtime API feature. Compare the behavior with the referenced capa-rules pull request 654 and determine whether the extractor, vivisect, or another component causes the inconsistency; done means the cause is identified and the extraction result is reliable.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.