mandiant / mandiant/capa

dynamic: default render group by process?

Open
#1,866 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

dynamic enhancement
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

for verbose output we see the process name/details

I think for the dynamic context this could be helpful to show in the default output as well

related: show a summary/tree view of the traced processes

as test example use (UPX packed): cd2cba9e6313e8df2c1273593e649682 which creates a service resulting in execution in services.exe and svchost.exe

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the default and verbose output with the UPX-packed sample cd2cba9e6313e8df2c1273593e649682, which executes through services.exe and svchost.exe. Trace the dynamic-context rendering and review the related process summary/tree request; done means the default output groups or presents traced process details as intended.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cli, reverse-engineering
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.