use symtab entries to provide names for statically linked functions
Open
enhancement
- Dominant language
- Python
- Stars
- 6.2k
- Forks
- 726
- Avg merge
- 11d 11h
- Merged PRs (30d)
- 7
Description
via discussion in https://github.com/mandiant/capa-rules/issues/736
for ELF samples, parse the .symtab, if present to provide:
```[tasklist]
- [x] ELF: use symtab entries for API feature function names
- [x] ELF: use symtab entries for function-name features
- [x] implement for vivisect #1443
- [ ] https://github.com/mandiant/capa/issues/1503
- [ ] https://github.com/mandiant/capa/issues/1504
```
Contributor guide
Research direction
Read the linked capa-rules discussion (#736) and capa issues #1503 and #1504 first; the checklist marks the ELF and vivisect portions complete. Confirm what work remains before changing anything, since the issue does not name a file, test, or unresolved implementation scope.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- reverse-engineering
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100