Regression: crash in compute_static_layout when using binja extractor
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 6.2k
- Forks
- 726
- Avg merge
- 11d 11h
- Merged PRs (30d)
- 7
Description
I got this crash today when I analyze 2f7f5fb5de175e770d7eae87666f9831.elf_. Note -- https://github.com/mandiant/capa/pull/2732 must be applied first or otherwise you will get a crash before getting to compute_static_layout
Traceback (most recent call last):
File "/Users/xusheng/capa-env/bin/capa", line 7, in <module>
sys.exit(main())
^^^^^^
File "/Users/xusheng/capa/capa/main.py", line 1042, in main
meta.analysis.layout = capa.loader.compute_layout(rules, extractor, capabilities.matches)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/Users/xusheng/capa/capa/loader.py", line 675, in compute_layout
return compute_static_layout(rules, extractor, capabilities)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/Users/xusheng/capa/capa/loader.py", line 653, in compute_static_layout
assert addr in functions_by_bb
^^^^^^^^^^^^^^^^^^^^^^^
AssertionError
This issue is long known, it was first reported in https://github.com/mandiant/capa/issues/2406#issuecomment-2490171179. I then tracked down the root cause https://github.com/mandiant/capa/issues/2516, which is then fixed by https://github.com/mandiant/capa/pull/2523. This also led to the creation of a binja issue: https://github.com/Vector35/binaryninja-api/issues/6222
It is unclear to me what is causing the regression
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in capa/loader.py at compute_static_layout and the failing assertion around line 653, reproducing with 2f7f5fb5de175e770d7eae87666f9831.elf_ after applying PR 2732. Read issues 2406 and 2516, PR 2523, and Binary Ninja issue 6222 to trace the regression. Done means the sample analysis no longer crashes at compute_static_layout.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100