mandiant / mandiant/capa

dotnet: detect OS

Open
#1,319 11 comments 0 reactions 0 assignees View on GitHub
dotnet enhancement
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

Research and implement if its possible to determine OS for .NET file; these should all be PEs so my best guess without further research is focusing on statically detecting the CLR

Maybe start with exploring [TargetFrameworkAttribute](https://learn.microsoft.com/en-us/dotnet/api/system.runtime.versioning.targetframeworkattribute?view=net-7.0)?

Contributor guide

Open the contributing guide

Research direction

Start by researching whether PE files can statically reveal their target operating system through CLR metadata, including the TargetFrameworkAttribute mentioned in the issue. Determine a reliable detection approach and define what OS-identification results would count as complete before locating the appropriate capa implementation and tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
operating-systems, reverse-engineering
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.