mandiant / mandiant/capa

Support saving the extracted features to disk

Open
#2,731 4 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

I suggest that create a way to save (serialize) the extracted features to disk, and then load it and do the matching directly from there. It is useful in a few cases:

1. Create unit test for the feature extractor, e.g., the binja extractor
2. Separate the feature extractor and the matching process, e.g., for TTD, we might want to run some C++ code to do the feature extraction, save it, and then do the matching elsewhere
3. Write the binja extractor in C++ which is more performant

Contributor guide

Open the contributing guide

Research direction

Start by tracing the binja feature extractor and the matching process to understand the extracted feature representation and their current coupling. Define a serialized format that can be saved, loaded, and consumed by matching, including the cross-language C++ use case. Done means extracted features can be persisted and later used for matching, with coverage for the proposed unit-test workflow.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, python
Domain
reverse-engineering
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.