bug(ghidra): function truncation during analysis
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 6.2k
- Forks
- 726
- Avg merge
- 11d 11h
- Merged PRs (30d)
- 7
Description
### Describe the bug
When analyzing complex binaries using the Ghidra extractor, certain functions are prematurely truncated. This happens because the current implementation relies on strict control flow graph (CFG) traversal, which can miss disconnected or complex basic blocks.
### Steps to Reproduce
1. Analyze a heavily obfuscated or complex binary using Ghidra with capa.
2. Observe that the number of identified basic blocks for certain functions is lower than expected.
3. Note that features within the "missing" blocks are not extracted.
### Expected behavior
The extractor should identify all basic blocks belonging to a function's scope to ensure 100% feature coverage.
### Additional context
This issue will be addressed by implementing flow-insensitive block discovery within the Ghidra feature extractor. This ensures that even if the CFG is fragmented, all blocks assigned to the function by Ghidra's analysis are processed.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in the Ghidra feature extractor and trace how function basic blocks are discovered through CFG traversal. Compare that with the blocks assigned to a function by Ghidra, then validate the change by analyzing complex or obfuscated binaries and confirming that features from all assigned blocks are extracted.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100