mandiant / mandiant/capa

Support regex matching on function-name/export feature?

Open
#2,049 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

### Summary

Support more flexible matching on ~~`function-name`~~ `export` features, e.g. like string/regex.

Alternatively/additionally consider other features that could benefit.

EDIT: in further discussion, it was concluded that regexes on `export` features would be most applicable here

### Motivation

Match JNI entry functions starting with `Java_`.

### Downsides

Performance may suffer due to search vs. contains.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing how capa currently matches export features and where feature matching is tested; the issue does not name a file or test. Define the expected regex behavior using JNI exports beginning with Java_, then assess the performance tradeoff and add coverage for the chosen matching semantics.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
reverse-engineering
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.