ttd-capa

ttd-capa is a capability extractor that works with Time Travel Debugging (TTD) traces to identify the capabilities exercised by a binary during its runtime execution. Designed to enhance the analysis of packed or obfuscated malware, it generates CAPA-compatible reports that allow for the extraction of runtime capabilities, leveraging full execution context and timestamp data for detailed analysis. Notable features include automatic resolution of string arguments, reconstruction of execution order, and integration with existing CAPA rule sets for comprehensive malware triage.