demangle function-name features via demumble
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 6.2k
- Forks
- 726
- Avg merge
- 11d 11h
- Merged PRs (30d)
- 7
Description
https://github.com/stevemk14ebr/RETools/tree/master/demumble
@stevemk14ebr
when extracting names from FLIRT matches, attempt to demangle them. then, allow users to reference demangled names from rules.
this is:
- easier for a human to read and cross reference
- maybe more portable, i.e. a single statement match across more compilers? i'm not totally sure.
but maybe there's a risk that not all compilers are supported by demumble, so this feature would only work for some binaries?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the demumble project linked in the issue, then trace how capa extracts names from FLIRT matches and how rules reference those names. Determine the supported demangling behavior and define tests showing that demangled names can be extracted and matched by rules without breaking binaries or compilers that are unsupported.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- reverse-engineering
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100