A faster rewrite of capa in golang.
- Proof-of-concept (PoC)
- Blazingly fast
- x86/x86-64 support
- PE support
- ELF support
- Compiled in rules
- A bunch of the standard rule features in capa (namespace, class, characteristic, etc.)
- characteristic
- namespace
- class
- api
- not properly implemented
- property
- number
- string and substring
- bytes
- offset
- mnemonic
- operand
- string and substring
- export
- import
- section
- function-name
- namespace
- class
- os
- arch
- format
For builtin rules
./gapa -file ./file.ext
or, for custom rules
./gapa -file ./file.ext -rule-folder /path/to/rules
You need capstone and go.
Run
go build
to build the project
Capa is incredibly slow and it annoyed me. The goal of this project is to use the same rules and acheive a result faster.