mandiant / capa

The FLARE team's open-source tool to identify capabilities in executable files.
https://mandiant.github.io/capa/
Apache License 2.0
4.14k stars 522 forks source link

feat: auto-generate ruleset cache on source change #2133

Closed s-ff closed 1 month ago

s-ff commented 3 months ago

Closes #1898. This is a proposal for the issue discussed in #1898.

Let's test out its feasibility and make sure it does not introduce an overhead.

mr-tz commented 3 months ago

Do you think it's possible to cleanly move the dev/git logic into capa.main?

agree here to move this to capa.main or a utils file.

s-ff commented 3 months ago

beyond splitting this up we'd prefer to call this from capa.main (and not deep in the library) can we add the check if this is a dev environment there instead? (e.g. around get_rules)

Moving the dev environment checks to capa.main and importing them from capa.main would create circular dependencies when I tested it.

mr-tz commented 3 months ago

beyond splitting this up we'd prefer to call this from capa.main (and not deep in the library) can we add the check if this is a dev environment there instead? (e.g. around get_rules)

Moving the dev environment checks to capa.main and importing them from capa.main would create circular dependencies when I tested it.

I mean to call it from there not to implement them in main.

mr-tz commented 2 months ago

Any concerns or blockers before merging this?

mr-tz commented 1 month ago

ping @s-ff, @williballenthin, @mike-hunhoff