mandiant / mandiant/capa

vmray: skipping deref param type void_ptr/ptr

Open
#2,407 0 comments 1 reaction 0 assignees View on GitHub
dynamic enhancement vmray
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

for internal sample 7263937 getting a lot of debug output like

```
DEBUG:capa.features.extractors.vmray.call:skipping deref param type void_ptr
...
DEBUG:capa.features.extractors.vmray.call:skipping deref param type ptr
```

potentially something to enhance down the road

Contributor guide

Open the contributing guide

Research direction

Start with the VMRay call extractor and its capa.features.extractors.vmray.call debug messages, then reproduce the output using internal sample 7263937. Determine the intended handling for void_ptr and ptr dereference parameters; done should include the agreed behavior and verification that the repetitive debug messages are addressed.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
reverse-engineering
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.