mandiant / mandiant/capa

design mutex HBI feature for use in dynamic analysis

Open
#1,560 0 comments 0 reactions 0 assignees View on GitHub
breaking-change dynamic enhancement
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

let's discuss the requirements and sketch a design for how this feature should look and act. the idea is to represent a mutex artifact that is manipulated during a dynamic analysis session.

this should include how the rule syntax changes, the format of the feature and properties of the feature, and at least two example rules showing how the feature would be used.

once we're happy with the design, then lets plan for opening a standalone PR with the Registry feature.

open questions include:
- how to represent operations, like create/acquire
- how to represent namespace versus path
- how to combine all the above with logic, or not. and how this affects rule syntax

Contributor guide

Open the contributing guide

Research direction

No files, tests, or entry points are named. Start by reviewing the existing rule syntax and feature representations, then compare them with the requested mutex operations, namespace/path handling, and logic questions. Done means a documented design, updated syntax definition, feature format and properties, and at least two example rules.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
reverse-engineering, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.