Add support for ELF Core dumps
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 6.2k
- Forks
- 726
- Avg merge
- 11d 11h
- Merged PRs (30d)
- 7
Description
Summary
Would it be possible to add support for ELF core dump files, as created by gcore, gdb etc.
Motivation
Ability to analyse dumped process memory on Linux. Helping to investigate code injection.
Describe alternatives you've considered
Currently capa provides an error message "Input file does not appear to target a supported OS" when trying to run it against a core dump. Modified the e_type field to either ET_EXEC / ET_DYN in the executable header of a core file to see if it enabled to capa to run. This didn't work either.
Additional context
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the reported failure by running capa against an ELF core dump and trace the input-format handling that emits the unsupported-OS error. Review how executable files are currently recognized, then define the required core-dump support and tests that demonstrate capa can analyze Linux process-memory dumps.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux, python
- Domain
- operating-systems, reverse-engineering
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100