capa
capa copied to clipboard
extract the union of features from multiple extractors
when multiple extractors, e.g. native PE and dotnet, can extract features from a binary, e.g. a mixed-mode dotnet program, should we extract the union of features from both extractors? or consider the features separately?
the union seems intuitive and is my intuitive preference, but needs further thought and/or discussion
introduced in #955 multiple file-level extractors can run on the same file
the full-feature extraction is not yet implemented that way and will require either
- harder:
- more refactoring
- ways to merge metadata, capabilities, etc. by each extractor
- easier:
- modifying the results document to contain multiple results
- display multiple results tables on the CLI
so far this would only apply to mixed-mode assemblies, which are rather rare