discussion: capa doesn't extract features from packed files about capa HOT 5 CLOSED

Adding a warning in the tool but also a warning in the README would be awesome!

from capa.

Notes on current limitations can be found at https://github.com/fireeye/capa/blob/master/doc/limitations.md

from capa.

From the SANS DFIR chat:

Dr. Pepper
Is it possible to write a decryptor/unpacker for capa? For example if a binary uses aplib, could we write something for capa to automatically decompress and run the rest of the rules on that data?

We have ideas for some method of auto-unpack to deal with common packers (UPX, ASPack, etc) and an integration is definitely worth exploring further.

from capa.

Kewl, nice for the limitations.md!

from capa.

we've documented the limitations and emit warnings when encountering packed files. we are no longer considering building an unpacker into capa - its a large amount of effort that will still fail pretty often.

unpacking is left to the user; however, capa should still recommend unpacking techniques when it can.

from capa.