mandiant / mandiant/capa

Modify "show results by function" to include hits not in a defined function

Open
#1,304 0 comments 0 reactions 0 assignees View on GitHub
enhancement ida-explorer
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

I think it would be helpful to display file-level hits as well as mapped locations that are not associated with an address in this display mode (maybe we rename it or add a new one).

This code fires when the user selects "show results by function" so I think it's best to exclude the file results here to keep it concise. But open to change if opinions fall strongly in the other direction.

_Originally posted by @mike-hunhoff in https://github.com/mandiant/capa/pull/1302#discussion_r1093424625_

Contributor guide

Open the contributing guide

Research direction

Start by locating the implementation of the “show results by function” display mode and review the discussion referenced in the issue. Determine how file-level hits and mapped locations without an associated function are represented, then define the display behavior and naming before validating the updated output.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cli, reverse-engineering
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.