Broken offset matching in IDA
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 6.2k
- Forks
- 726
- Avg merge
- 11d 11h
- Merged PRs (30d)
- 7
Description
### Description
During the development of rules for donut-related rules, it is discovered that `offset` keyword does not match instructions that should match per capa's specs. When investigated, I found out that the `offset` matching behavior within capa standalone and IDA capa explorer differs. At the moment, the `offset` matching works in capa standalone but not within IDA.
### Steps to Reproduce
1. Open shellcode sample referenced in https://github.com/mandiant/capa-rules/pull/997 in IDA
2. Open capa explorer
3. Wait for analysis results
**Expected behavior:**
Rules that use the `offset` keyword to match the relevant instructions
**Actual behavior:**
Sample does not match the `offset` keyword defined within the rule
### Versions
- capa 9.1.0 (3bd339522e57afe4b1103ca00bfac928cdcb8f2c)
- IDA Pro 9.0.241217
- vivisect
viv_utils 0.8.0
vivisect 1.2.1
### Additional Information
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the mismatch with the shellcode sample referenced in capa-rules PR 997, using IDA Pro's capa explorer. Compare how the offset keyword is matched in capa standalone and the IDA integration, then verify that the relevant rules match in both environments. The issue is for capa 9.1.0 with IDA Pro 9.0.241217, viv_utils 0.8.0, and vivisect 1.2.1.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- reverse-engineering, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100