mandiant / mandiant/capa

When running capa with Binary Ninja backend, Binja not found

Open
#2,544 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

binary-ninja bug
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

### Description

When running capa against shellcode using the Binary Ninja backend, capa indicates the Binary Ninja API is not found.
Mentioning @xusheng6 since I believe he works issues related to Binja. Thank you!

### Steps to Reproduce

Run capa on shellcode using Binary Ninja as a backend with the following command:
`C:\Tools\capa.exe -r C:\Tools\capa-rules -f sc64 sc.bin -b binja -d`

**Expected behavior:**
capa should analyze the shellcode file with the binary ninja backend and report any detected capabilities based on the specified rules.

**Actual behavior:**
The above command produces the following error:
```
DEBUG capa: using rules path: C:\Tools\capa-rules main.py:495
DEBUG capa.rules: reading rules from directory C:\Tools\capa-rules __init__.py:2101
DEBUG capa.rules.cache: loading rule set from cache: C:\Users\REM\AppData\Local\flare\capa\cache\capa-6b587440.cache cache.py:150
DEBUG capa: successfully loaded 969 rules main.py:683
DEBUG capa.features.extractors.common: unsupported file format: fc4883e4, will not guess OS common.py:141
DEBUG capa: skipping library code matching: only supported by the vivisect backend main.py:783
DEBUG capa: format: sc64 main.py:833
DEBUG capa: backend: binja main.py:834
DEBUG capa.features.extractors.binja.find_binja_api: Binary Ninja API not installed, searching... find_binja_api.py:149
WARNING capa.features.extractors.binja.find_binja_api: unsupported platform to find Binary Ninja: win32 find_binja_api.py:110
DEBUG capa.features.extractors.binja.find_binja_api: failed to find Binary Ninja installation find_binja_api.py:153
DEBUG capa.features.extractors.binja.find_binja_api: found Binary Ninja API: None find_binja_api.py:155
Traceback (most recent call last):
File "main.py", line 1103, in
File "main.py", line 990, in main
File "main.py", line 837, in get_extractor_from_cli
File "loader.py", line 246, in get_extractor
RuntimeError: cannot find Binary Ninja API module.
[PYI-4732:ERROR] Failed to execute script 'main' due to unhandled exception!
```

### Versions
capa version: 8.0.1
capa rules version: 8.0.1
Installed as: Tried both Python library and standalone EXE
Backend: Binary Ninja 4.2.6455 (Personal License)

### Additional Information
- I installed the Binary Ninja API as described here: https://docs.binary.ninja/dev/batch.html#install-the-api.
- I manually executed `python find_binja_api.py` (the file referenced in the debug output), and it outputs the path `C:\Users\REM\AppData\Local\Programs\Vector35\BinaryNinja\python`.
- I also ran this code, located in `find_binja_api.py`, with the following output:
```
>>> import importlib.util
>>> importlib.util.find_spec("binaryninja")
ModuleSpec(name='binaryninja', loader=<_frozen_importlib_external.SourceFileLoader object at 0x000001F77ABE8350>, origin='C:\\Users\\REM\\AppData\\Local\\Programs\\Vector35\\BinaryNinja\\python\\binaryninja\\__init__.py', submodule_search_locations=['C:\\Users\\REM\\AppData\\Local\\Programs\\Vector35\\BinaryNinja\\python\\binaryninja'])
```

Any ideas are much appreciated. Thank you!

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with find_binja_api.py and reproduce the reported Windows command using the Binary Ninja backend. Compare its API discovery behavior with the documented installation and the successful importlib.util.find_spec("binaryninja") result. Done means capa can locate the Binary Ninja API and analyze the shellcode without the RuntimeError.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.