mandiant / mandiant/capa

Binary Ninja installation path detection does not work on macOS

Open
#2,641 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

binary-ninja bug
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

I ran capa on macOS with the binja backend but it does not seem to detect the installation path correctly. Here is the output:

```
% ./capa -d -b binja ~/Downloads/[private].bndb
DEBUG capa: -------------------------------------------------------------------------------- main.py:475
DEBUG capa: Using default embedded rules. main.py:476
DEBUG capa: To provide your own rules, use the form: main.py:477
DEBUG capa: main.py:478
DEBUG capa: `capa.exe -r ./path/to/rules/ /path/to/mal.exe`. main.py:479
DEBUG capa: main.py:480
DEBUG capa: You can see the current default rule set here: main.py:481
DEBUG capa: main.py:482
DEBUG capa: https://github.com/mandiant/capa-rules main.py:483
DEBUG capa: -------------------------------------------------------------------------------- main.py:484
DEBUG capa.features.extractors.common: unknown file format: 53514c69 common.py:85
DEBUG capa.rules: reading rules from directory /var/folders/0b/0ccr7qgn5p1_vvjrz7mn74z00000gn/T/_MEIANcNkQ/rules __init__.py:2167
DEBUG capa.rules.cache: loading rule set from cache: /var/folders/0b/0ccr7qgn5p1_vvjrz7mn74z00000gn/T/_MEIANcNkQ/cache/capa-c2011a71.cache cache.py:157
DEBUG capa: successfully loaded 974 rules main.py:693
DEBUG capa.features.extractors.common: unsupported file format: 53514c69, will not guess OS common.py:148
DEBUG capa: skipping library code matching: only supported by the vivisect backend main.py:817
DEBUG capa: format: binja_database main.py:867
DEBUG capa: backend: binja main.py:868
DEBUG capa.features.extractors.binja.find_binja_api: Binary Ninja API not installed, searching... find_binja_api.py:156
WARNING capa.features.extractors.binja.find_binja_api: unsupported platform to find Binary Ninja: darwin find_binja_api.py:114
DEBUG capa.features.extractors.binja.find_binja_api: failed to find Binary Ninja installation find_binja_api.py:160
DEBUG capa.features.extractors.binja.find_binja_api: found Binary Ninja API: None find_binja_api.py:162
Traceback (most recent call last):
File "main.py", line 1149, in
File "main.py", line 1033, in main
File "main.py", line 871, in get_extractor_from_cli
File "loader.py", line 254, in get_extractor
RuntimeError: cannot find Binary Ninja API module.
[PYI-76527:ERROR] Failed to execute script 'main' due to unhandled exception!
```

I checked the source code and noticed a few things:

1. `is_binaryninja_installed` should return True, since I can run `importlib.util.find_spec("binaryninja")` get the result just fine. Not sure why it does not work
2. `find_binaryninja_path_via_subprocess` actually obtains the correct path of the binja python modeule, i.e., in `/Applications/Binary Ninja.app/Contents/Resources/python` (the default installation). However, the `validate_binaryninja_path` method tries to append another `python` into the path, so it breaks it. I see that `validate_binaryninja_path` is also used to validate the binja path obtained from the Linux desktop file. Maybe the path obtained there does not already have the `python` in it so it works? Anyways, the difference here needs to be fixed
3. We should also add macOS and Windows binja path detection by looking at the default installation

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in find_binja_api.py, especially is_binaryninja_installed, find_binaryninja_path_via_subprocess, and validate_binaryninja_path. Trace how paths from the subprocess and Linux desktop-file lookup are validated, then inspect the default macOS and Windows installation locations requested in the issue. Done means the binja backend resolves the Binary Ninja API on the reported platforms without duplicating path components.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
reverse-engineering
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.