skip matching rules in code within functions that are only called from library functions
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 6.2k
- Forks
- 726
- Avg merge
- 11d 11h
- Merged PRs (30d)
- 7
Description
### Summary
Some functions that are not identified as library functions but are only called from library functions do match capa rules. An enhancement would be to skip matching rules associated to capabilities not only within library functions but also within functions only called from library functions.
### Motivation
As capa is aimed at detecting capabilities and behaviours within the programmer's code and not within library code this will reduce the hits an analyst have to look at that are relevant.
### Describe alternatives you've considered
Skip finding capabilities and behaviours within functions that are not originally detected as library code but it i safe to assume they are library functions since they are only called from library code.
## Additional context
Seen in a DLL where the library function __IsNonwritableInCurrentImage calls the function sub_1000AFD0, not detected as library function by IDA Pro.


Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how capa identifies library functions and matches rules, using the reported DLL case involving __IsNonwritableInCurrentImage and sub_1000AFD0. Reproduce the example in IDA Pro or capa, then verify that capabilities in functions reachable only from library functions are skipped while programmer-code matches remain.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- reverse-engineering, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100