capa
capa copied to clipboard
feature: function count
rule:
meta:
name: contain few functions
examples:
- 068a76d4823419b376d418cf03215d5c
features:
- count(function): 10 or less
Is something like this possible or would we need a new feature?
Would it be worth adding? Currently I can only think of using this for packer detection.
EDIT: also for anti-disassembly, see PMA chapter 15
Is something like this possible or would we need a new feature?
I don't think we can do this today. Function features bubble up to File features, so the scope: file
would be appropriate; however, we don't extract a feature for each function start (how else would this be used?) so there's nothing relevant to work with at the file scope.
we could approximate this today like so:
scope: file
features:
- count(characteristic(calls to)): 10 or less
which says: "there are ten or fewer resolved calls". though, i find this to be a kinda tricky rule - would need to document it well.
(note: i haven't tested this rule, but i think it should work)
unfortunately not: invalid rule: feature characteristic(calls to) not support for scope file