Willi Ballenthin

are "global stackstrings" seen in the wild?

3

malware that uses a stackstrings-like technique to initialize a global string will not be detected by the stackstrings extractor, since we currently inspect only the active stack frame. the decoding...

https://github.com/fireeye/speakeasy/

e4732a029fdd3aaebd689481f7e0a57e

dotnet: how to represent getter/setters

12

dotnet may emit accessor/mutators (getter/setters) for some fields rather than direct field access. how do we recognize and emit these features?

dotnet: consider emitting references to types

7

methods interact with various types, including both primitive objects (u8) and classes. sometimes we see method/property access to the classes, which can be represented by things like `API` (and maybe...

flirt: consider using rizin/sigdb signatures

2

https://github.com/rizinorg/sigdb

how to bundle TreeSitter bindings

1

_Originally posted by @williballenthin in https://github.com/mandiant/capa/pull/1080#discussion_r912047439_ ideally, we want to be able to install capa simply by doing `pip install flare-capa` and/or fetching the standalone executable from github (generated via...