dynamic: enable matching call arguments
- Dominant language
- Python
- Stars
- 6.2k
- Forks
- 726
- Avg merge
- 11d 11h
- Merged PRs (30d)
- 7
Description
This has been discussed before (https://github.com/mandiant/capa/issues/771, https://github.com/mandiant/capa/discussions/921) regarding static analysis but I do not believe we've revisited this since adding dynamic analysis. I think this is 100% worth implementing for dynamic analysis, now that we have easy access to call argument order, names, and values, to reduce FPs, e.g. https://github.com/mandiant/capa-rules/issues/1023.
Contributor guide
Research direction
Start by reviewing the linked capa issues and discussion, then inspect the dynamic-analysis handling of call argument order, names, and values. Define how argument matching should work and identify relevant tests before implementing it; done means dynamic rules can match those arguments and reduce false positives such as the referenced capa-rules issue.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- reverse-engineering, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100