binja: `get_instruction` should attach the list of associated LLIL instructions to the instruction object
- Dominant language
- Python
- Stars
- 6.2k
- Forks
- 726
- Avg merge
- 11d 11h
- Merged PRs (30d)
- 7
Description
At https://github.com/mandiant/capa/blob/688841fd3b337865c7affb39ac62c6454f9c4d94/capa/features/extractors/binja/extractor.py#L78
Currently, several instruction level analysis tries to get the associated LLIL instruction given an address using the API `get_llil_at` or `get_llils_at`. These should be avoided and the lookup should better be just done once
Contributor guide
Research direction
Start in capa/features/extractors/binja/extractor.py around line 78 and inspect how instruction objects are created. Trace the get_llil_at and get_llils_at call sites to understand the current repeated lookups. Done means the instruction object carries its associated LLIL instructions and instruction-level analysis no longer performs those lookups repeatedly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- reverse-engineering
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100