pull function scope features into file scope about capa HOT 8 CLOSED

thanks Ana for investigating!

from capa.

documenting offline discussion:

Instead of adding a new program scope, we want to add function scope to file scope. This is clearer than having a program and a file scope.

from capa.

turns out that right now we include subscope (function, basic block) matches to the file scope. this means file rules are already able to reason about matches across the entire file. is this sufficient?

alternatively, do we want to bubble up all of the function scope features to the file scope? this would be pretty trivial to add, but is it necessary?

pro: maybe could write more expressive rules (though i think we should demonstrate such a rule or two first)
con: increased memory usage/decreased performance at file scope (probably millions of entries in the ctx index)

from capa.

in any case, we should add a test or two that demonstrates the existing file-scope matching.

from capa.

The implementation to to bubble up all of the function scope features to the file scope: https://github.com/fireeye/capa/compare/ana-program-scope

from capa.

@williballenthin

con: increased memory usage/decreased performance at file scope (probably millions of entries in the ctx index)

I think the number of false positives will increase as well. Maybe we should focus on implementing child functions instead of modifying the current file scope.

in any case, we should add a test or two that demonstrates the existing file-scope matching.

We have the test_subscope_rules() and test_match_across_scopes_file_function tests already. Do we need more tests? I am not sure what kind of test would be the best for this.

from capa.

I think the number of false positives will increase as well.

good point. even if we add this feature, we should figure out how to avoid the temptation of using file scope when really we just don't support something (like child functions).

i like the idea of returning our attention towards child functions.

from capa.

suggesting to implement test_match_across_scopes_file_function was exactly what i had in mind. seems like we already have this feature 🤦.

i suggest we close out this issue.

from capa.