Willi Ballenthin

Results 328 comments of Willi Ballenthin

one strategy: Rust has good TreeSitter library support and can statically link language bindings. Rust also has great Python binding support via PyO3, which is how we distribute our implementation...

i'll triage this, maybe on monday or tuesday. unfortunately, we're at the whim of the underlying analysis engine, so unless there's a quick fix, we may just have to accept...

getting a ghidra plugin working is pretty high on my priority list (especially adding py3 ;-) ), and i know @psifertex is actively working on BN. so, we'll soon have...

yeah, vivisect has a configurable set of analysis passes; however, i believe they're all enabled by default, so there's not a dial that we could turn further. but, we could...

in the sample originally provided by @re-fox, the function in question contains a good deal of anti-disassembly. for example: ![image](https://user-images.githubusercontent.com/156560/89241998-b32fa200-d5bd-11ea-8591-15dbb11472de.png) (this is consistent with the ghdira screenshots above). IDA is...

i think this is done @mike-hunhoff ?

see also #377 that proposes to render by function address

> Is something like this possible or would we need a new feature? I don't think we can do this today. Function features bubble up to File features, so the...

we could approximate this today like so: ```yml scope: file features: - count(characteristic(calls to)): 10 or less ``` which says: "there are ten or fewer resolved calls". though, i find...

lets not migrate to the `capa` name in v2.0 - its just two days away and would be a pretty big change for our users. maybe we plan to do...