capa
capa copied to clipboard
dynamic: vmray: add support for "array" function call parameters
The "array" type roughly maps to series of bytes and integers. We must first determine if capa can emit features from arrays without polluting the matches.
e.g.
[...]
<member name="IdentifierAuthority.Value" type="array" num_elements="6">
<item type="unsigned_8bit" value="0x0"/>
<item type="unsigned_8bit" value="0x0"/>
<item type="unsigned_8bit" value="0x0"/>
<item type="unsigned_8bit" value="0x0"/>
<item type="unsigned_8bit" value="0x0"/>
<item type="unsigned_8bit" value="0x5"/>
</member>
[...]