mandiant / mandiant/capa

show .NET function name when its helpful

Open
#1,340 0 comments 0 reactions 0 assignees View on GitHub
dotnet enhancement
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

> I'm honestly torn here. I think displaying un-obfuscated method names is valuable, however, my work has seen few samples where this is the case. More frequently, I see large, obfuscated names that would be a pain to handle (display) correctly.
>
> We could take a route simliar to de4dot by attempting to identify and rename obfuscated method names but I see that potentially confusing users who pivot from capa to a tool like dnSpy.
>
> Reading your original message I see you say "when possible" which could be a valid path forward, e.g., we only display method names when we can identify the name has not been obfuscated at all (or past an established threshold).

I agree with everything you say here. I'd only recommend including the name when its useful and helpful. I do *not* think we should do any renaming or show any obfuscated names. So, if its reasonably easy to determine if a name is non-obfuscated, then I think we should maybe do that.

How to determine if non-obfuscated? I guess ASCII only, something around entropy, not mixing casing or numbers too weirdly, ...?

We should probably move this into a separate feature request.

_Originally posted by @williballenthin in https://github.com/mandiant/capa/issues/1326#issuecomment-1450098256_

Contributor guide

Open the contributing guide

Research direction

The issue names no files, tests, or entry points. Start by locating how capa currently renders .NET function names, then define and document what counts as a useful non-obfuscated name; done means acceptable names are shown while obfuscated names are omitted, with tests covering the decision.

Written by the indexing model from the issue text.

Assessment

Domain
reverse-engineering
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.