mandiant / mandiant/capa

skip matching rules in code within functions that are only called from library functions

Open
#989 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

dont merge enhancement performance usability
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

### Summary

Some functions that are not identified as library functions but are only called from library functions do match capa rules. An enhancement would be to skip matching rules associated to capabilities not only within library functions but also within functions only called from library functions.

### Motivation

As capa is aimed at detecting capabilities and behaviours within the programmer's code and not within library code this will reduce the hits an analyst have to look at that are relevant.

### Describe alternatives you've considered

Skip finding capabilities and behaviours within functions that are not originally detected as library code but it i safe to assume they are library functions since they are only called from library code.

## Additional context
Seen in a DLL where the library function __IsNonwritableInCurrentImage calls the function sub_1000AFD0, not detected as library function by IDA Pro.

Screenshot 2022-04-11 at 12 19 22

Screenshot 2022-04-11 at 12 19 30

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing how capa identifies library functions and matches rules, using the reported DLL case involving __IsNonwritableInCurrentImage and sub_1000AFD0. Reproduce the example in IDA Pro or capa, then verify that capabilities in functions reachable only from library functions are skipped while programmer-code matches remain.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
reverse-engineering, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.