mandiant / mandiant/capa

emit number(0) (offset(0)??) for instructions like "XOR EAX, EAX"

Open
#2,622 22 comments 1 reaction 0 assignees View on GitHub
enhancement question
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

see https://github.com/mandiant/capa-rules/pull/993#issuecomment-2711090176

Contributor guide

Open the contributing guide

Research direction

Start by reading the linked capa-rules pull request comment, which contains the only reported context. Trace how instruction operands are represented and emitted for the XOR EAX, EAX example, then clarify whether the expected result is number(0) or offset(0). Done means the intended zero-valued representation is emitted consistently and covered by a relevant test.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.