mandiant / mandiant/capa

binja: `get_instruction` should attach the list of associated LLIL instructions to the instruction object

Open
#2,520 2 comments 0 reactions 0 assignees View on GitHub
binary-ninja bug
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

At https://github.com/mandiant/capa/blob/688841fd3b337865c7affb39ac62c6454f9c4d94/capa/features/extractors/binja/extractor.py#L78

Currently, several instruction level analysis tries to get the associated LLIL instruction given an address using the API `get_llil_at` or `get_llils_at`. These should be avoided and the lookup should better be just done once

Contributor guide

Open the contributing guide

Research direction

Start in capa/features/extractors/binja/extractor.py around line 78 and inspect how instruction objects are created. Trace the get_llil_at and get_llils_at call sites to understand the current repeated lookups. Done means the instruction object carries its associated LLIL instructions and instruction-level analysis no longer performs those lookups repeatedly.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
reverse-engineering
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.