IDA fileoffset APIs Broken
Open
bug
ida
- Dominant language
- Python
- Stars
- 6.2k
- Forks
- 726
- Avg merge
- 11d 11h
- Merged PRs (30d)
- 7
Description
Using latest capa the call here can fail when reading the ELF header when the region being read is an ELF LOAD segment. Within this region IDA seems to have no mapping between VA's and file offsets using the ida_loader apis. This causes the capa error "CorruptElfFile" "missing magic header"
https://github.com/mandiant/capa/blob/ff773695d047d83a3b3911293043ec2bd327ef8d/capa/ida/helpers.py#L182
This has been reported to hexrays
Contributor guide
Research direction
Start in capa/ida/helpers.py around line 182 and investigate the ida_loader file-offset lookup while reading an ELF LOAD segment. Reproduce the failure in IDA with an affected ELF and verify that the CorruptElfFile "missing magic header" error no longer occurs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100