mandiant / mandiant/capa

ida: get_bytes may be padded with 0xFF for uninit'd bytes

Open Beginner friendly
#3,104 4 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

breaking-change bug ida
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

Image Image

otherwise, get_bytes will insert the byte 0xFF for uninitialized bytes, and it will return a buffer of exactly size.

for IDA extractor read_bytes_at, this probably isn't what we want, because our encountered byte features will have extra trailing junk at the end.

https://github.com/mandiant/capa/blob/2c12cbb4854265e013f03c42d1bb1404f198adc6/capa/features/extractors/ida/helpers.py#L237-L247

instead, we should pass gmb_flags=0 so that get_bytes stops at the first invalid byte.

alternatively, we could use get_bytes_and_mask and manually trim from the right, but i think this is likely to be much slower and harder to get right.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in capa/features/extractors/ida/helpers.py at read_bytes_at, especially lines 237-247, and review how get_bytes handles uninitialized bytes. Update the call so invalid bytes stop the returned buffer instead of adding trailing 0xFF values. Done means encountered byte features no longer contain trailing bytes from uninitialized regions.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
reverse-engineering
Issue type
Bug
Difficulty
1/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.