mandiant / mandiant/capa

Regression: crash in compute_static_layout when using binja extractor

Open
#2,734 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

binary-ninja bug
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

I got this crash today when I analyze 2f7f5fb5de175e770d7eae87666f9831.elf_. Note -- https://github.com/mandiant/capa/pull/2732 must be applied first or otherwise you will get a crash before getting to compute_static_layout

Traceback (most recent call last):
  File "/Users/xusheng/capa-env/bin/capa", line 7, in <module>
    sys.exit(main())
             ^^^^^^
  File "/Users/xusheng/capa/capa/main.py", line 1042, in main
    meta.analysis.layout = capa.loader.compute_layout(rules, extractor, capabilities.matches)
                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/xusheng/capa/capa/loader.py", line 675, in compute_layout
    return compute_static_layout(rules, extractor, capabilities)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/xusheng/capa/capa/loader.py", line 653, in compute_static_layout
    assert addr in functions_by_bb
           ^^^^^^^^^^^^^^^^^^^^^^^
AssertionError

This issue is long known, it was first reported in https://github.com/mandiant/capa/issues/2406#issuecomment-2490171179. I then tracked down the root cause https://github.com/mandiant/capa/issues/2516, which is then fixed by https://github.com/mandiant/capa/pull/2523. This also led to the creation of a binja issue: https://github.com/Vector35/binaryninja-api/issues/6222

It is unclear to me what is causing the regression

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in capa/loader.py at compute_static_layout and the failing assertion around line 653, reproducing with 2f7f5fb5de175e770d7eae87666f9831.elf_ after applying PR 2732. Read issues 2406 and 2516, PR 2523, and Binary Ninja issue 6222 to trace the regression. Done means the sample analysis no longer crashes at compute_static_layout.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.