mandiant / mandiant/capa

dynamic: enable matching call arguments

Open
#2,627 10 comments 0 reactions 0 assignees View on GitHub
dynamic enhancement
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

This has been discussed before (https://github.com/mandiant/capa/issues/771, https://github.com/mandiant/capa/discussions/921) regarding static analysis but I do not believe we've revisited this since adding dynamic analysis. I think this is 100% worth implementing for dynamic analysis, now that we have easy access to call argument order, names, and values, to reduce FPs, e.g. https://github.com/mandiant/capa-rules/issues/1023.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the linked capa issues and discussion, then inspect the dynamic-analysis handling of call argument order, names, and values. Define how argument matching should work and identify relevant tests before implementing it; done means dynamic rules can match those arguments and reduce false positives such as the referenced capa-rules issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
reverse-engineering, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.