ida: get_bytes may be padded with 0xFF for uninit'd bytes
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 6.2k
- Forks
- 726
- Avg merge
- 11d 11h
- Merged PRs (30d)
- 7
Description
otherwise, get_bytes will insert the byte 0xFF for uninitialized bytes, and it will return a buffer of exactly size.
for IDA extractor read_bytes_at, this probably isn't what we want, because our encountered byte features will have extra trailing junk at the end.
instead, we should pass gmb_flags=0 so that get_bytes stops at the first invalid byte.
alternatively, we could use get_bytes_and_mask and manually trim from the right, but i think this is likely to be much slower and harder to get right.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in capa/features/extractors/ida/helpers.py at read_bytes_at, especially lines 237-247, and review how get_bytes handles uninitialized bytes. Update the call so invalid bytes stop the returned buffer instead of adding trailing 0xFF values. Done means encountered byte features no longer contain trailing bytes from uninitialized regions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100