ghidra: Integrate the FLIRT matching engine into the Ghidra Feature Extractor
#1.981 geöffnet am 9. Feb. 2024
Repository-Metriken
- Stars
- (6.043 Stars)
- PR-Merge-Metriken
- (PR-Metriken ausstehend)
Beschreibung
Summary
The Ghidra Feature Extractor uses Ghidra's FunctionID Analyzer to identify library functions. capa as a standalone tool defaults to the Vivisect backend, which uses the FLARE team's custom FLIRT matching engine alongside an open-source set of FLIRT signatures that cover many functions present in binaries that are compiled with Visual Studio. The FLIRT matching engine is implemented in Rust with Python bindings.
Motivation
By integrating the FLIRT matching engine with the Ghidra Feature Extractor, it will complement FunctionID and service users who wish to use their own set of FLIRT signatures. In turn, capa will be capable of identifying more library functions to be skipped during analysis.
Additional context
FunctionID allows Ghidra users to develop and use their own sets of signatures already; however, new users will only have access to the default ones. Our FLIRT signature set will serve to automatically grow this database and enhance capa's analysis.