capa icon indicating copy to clipboard operation
capa copied to clipboard
verified publisher icon mandiant

make string length configurable and consistent across backends

Open mr-tz opened this issue 3 years ago • 21 comments 

          should we make this configurable and consistent across backends?

Originally posted by @williballenthin in https://github.com/mandiant/capa/pull/1298#discussion_r1091841019

mr-tz avatar Feb 01 '23 13:02 mr-tz

Hi, I would like to work on this issue.

linpeiyu164 avatar Mar 11 '23 12:03 linpeiyu164

Go for it :)

mr-tz avatar Mar 14 '23 07:03 mr-tz

Hi, I would like to work on this issue.

fathi0x avatar Mar 31 '23 12:03 fathi0x

Sure, feel welcomed to open a PR with the changes.

williballenthin avatar Mar 31 '23 13:03 williballenthin

Sorry for the delay but I have made some initial changes. I have not tested it yet, but I will continue to update it.

linpeiyu164 avatar Mar 31 '23 17:03 linpeiyu164

Hi, I made the following changes in my PR and could use some advice:

  1. I added an additional argument in main.py (-l, –len) to allow users to configure the string length. (args.len)
  2. I changed the following extractors to take an additional argument (len) and pass it to their string extracting functions:
  • capa/features/extractors/dnfile/extractor.py: DnfileFeatureExtractor
  • capa/features/extractors/ida/extractor.py : IdaFeatureExtractor
  • capa/features/extractors/pefile.py: PefileFeatureExtractor
  • capa/features/extractors/viv/extractor.py: VivisectFeatureExtractor
  • capa/features/extractors/elffile.py: ElfFeatureExtractor
  • capa/features/extractors/dotnetfile.py: DotnetFileFeatureExtractor
  1. I changed the tests to use len=DEFAULT_STRING_LENGTH, which is defined in capa/features/extractors/strings.py as 4. Currently, I’m not sure how to allow users to pass in the len argument to IdaFeatureExtractor. I would appreciate any pointers, thanks!

linpeiyu164 avatar Apr 01 '23 15:04 linpeiyu164

I would like to work on this issue should i just open a PR ?

0xAtharv avatar Sep 25 '23 16:09 0xAtharv

we have an existing PR open in #1421 that needs a bit more work. i'd suggest picking a different issue to focus on, if possible.

williballenthin avatar Sep 25 '23 16:09 williballenthin

This issue can be tackled from scratch again. See comments/work in #1421 for reference.

mr-tz avatar Mar 22 '24 10:03 mr-tz