mandiant / mandiant/capa

pre-filter strings, bytes based on whats found in the file

Open
#2,126 0 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

performance
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

To avoid searching for strings/bytes that won't ever be found at a particular scope, we could first check that each string/bytes is present *somewhere* in the file.

If its not, then we can partially evaluate some rule logic (like `and` statements) to see if further logic can be pruned and/or rules skipped.

For example, we have HTTP User-Agent rules that contain tons of strings that match under a single `or`. If none are present in the file, we can skip the whole rule.

We'd want to ensure that the up-front scan to find the file matches doesn't take much time, and that it doesn't outweigh any performance improvements. Remember we may have hundreds or thousands of terms to look for. We can also use evaluation counts to show that less logic needs to be matched when some branches are pruned.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the rule-evaluation and string/bytes-matching entry points, then inspect how evaluation counts are collected. Benchmark the upfront file scan against current matching for rules with many terms, and define completion as a measurable improvement without making typical scans slower; verify that pruned branches and skipped rules are reflected in evaluation counts.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
performance, reverse-engineering
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.