mandiant / capa

The FLARE team's open-source tool to identify capabilities in executable files.
Apache License 2.0
3.99k stars 499 forks source link

Support regex matching on function-name/export feature? #2049

Open mr-tz opened 2 months ago

mr-tz commented 2 months ago

Summary

Support more flexible matching on function-name export features, e.g. like string/regex.

Alternatively/additionally consider other features that could benefit.

EDIT: in further discussion, it was concluded that regexes on export features would be most applicable here

Motivation

Match JNI entry functions starting with Java_<package_name>.

Downsides

Performance may suffer due to search vs. contains.