mandiant / mandiant/capa

Python flirt slows down analysis

Open
#1,272 9 comments 0 reactions 0 assignees View on GitHub
performance
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

I've noticed this before with vivisect and library matching. Using the default signatures analysis is very slow. Without signatures it's less slow. Can someone reproduce this before I investigate further?

Example binaries:
0b8a4b3d83f94cab837b9ff51e5d7928df49537b3813ea1e4bf2d954952fc1c9
0adb26cb948f3fe4c56ab663026c7c0630340cae461cae0b69a64e2f35a2fe3b

Contributor guide

Open the contributing guide

Research direction

Start by running analysis on the two example binaries with the default signatures enabled and disabled, comparing the runtimes and confirming the reported slowdown. Done means reproducing or disproving the performance difference and documenting the result clearly enough to guide further investigation.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
performance, reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.