mandiant / mandiant/capa

bug(ghidra): function truncation during analysis

Open
#2,989 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug ghidra
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

### Describe the bug
When analyzing complex binaries using the Ghidra extractor, certain functions are prematurely truncated. This happens because the current implementation relies on strict control flow graph (CFG) traversal, which can miss disconnected or complex basic blocks.

### Steps to Reproduce
1. Analyze a heavily obfuscated or complex binary using Ghidra with capa.
2. Observe that the number of identified basic blocks for certain functions is lower than expected.
3. Note that features within the "missing" blocks are not extracted.

### Expected behavior
The extractor should identify all basic blocks belonging to a function's scope to ensure 100% feature coverage.

### Additional context
This issue will be addressed by implementing flow-insensitive block discovery within the Ghidra feature extractor. This ensures that even if the CFG is fragmented, all blocks assigned to the function by Ghidra's analysis are processed.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in the Ghidra feature extractor and trace how function basic blocks are discovered through CFG traversal. Compare that with the blocks assigned to a function by Ghidra, then validate the change by analyzing complex or obfuscated binaries and confirming that features from all assigned blocks are extracted.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.