1 Repo
Plugins that integrate capability detection and rule authoring directly within the IDA Pro disassembler interface.
Distinct from IDA Pro Binary Analysis: Distinct from IDA Pro Binary Analysis: focuses specifically on the plugin that enables analysis within IDA Pro, not the general binary analysis capability.
Explore 1 awesome GitHub repository matching operating systems & systems programming · Plugins. Refine with filters or upvote what's useful.
capa is a static analysis tool that scans executable files to identify what a program can do, detecting capabilities such as API calls, byte sequences, and structural patterns without executing the code. It supports multiple file formats including PE, ELF, .NET, and shellcode, and can also process runtime behavior traces from sandbox reports generated by CAPE, DRAKVUF, or VMRay. The tool integrates directly with reverse engineering environments through plugins for IDA Pro and Ghidra, allowing analysts to view capability matches and author detection rules within their disassembler of choice. C
Integrates capability detection and rule authoring directly within the IDA Pro disassembler interface.