capa icon indicating copy to clipboard operation
capa copied to clipboard

extract the union of features from multiple extractors

Open williballenthin opened this issue 2 years ago • 2 comments

when multiple extractors, e.g. native PE and dotnet, can extract features from a binary, e.g. a mixed-mode dotnet program, should we extract the union of features from both extractors? or consider the features separately?

williballenthin avatar Apr 04 '22 16:04 williballenthin

the union seems intuitive and is my intuitive preference, but needs further thought and/or discussion

williballenthin avatar Apr 04 '22 16:04 williballenthin

introduced in #955 multiple file-level extractors can run on the same file

the full-feature extraction is not yet implemented that way and will require either

  • harder:
    • more refactoring
    • ways to merge metadata, capabilities, etc. by each extractor
  • easier:
    • modifying the results document to contain multiple results
    • display multiple results tables on the CLI

so far this would only apply to mixed-mode assemblies, which are rather rare

mr-tz avatar Apr 06 '22 07:04 mr-tz