capa very verbose ghidra backend breaks
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 6.2k
- Forks
- 726
- Avg merge
- 11d 11h
- Merged PRs (30d)
- 7
Description
Description
capa -vv -b ghidra <mysample> broke and gave an error (I reproduced the error several times, including in debug mode -> output attached as capabvv.txt) where capa -b ghidra <mysample> gave good output (capab.txt). This was sample specific, a few other samples I tested did not produce this error.
<mysample> SHA256: 00ae07c9fe63b080181b8a6d59c6b3b6f9913938858829e5a42ab90fb72edf7a (from: https://github.com/MalwareSamples/Linux-Malware-Samples)
I was running this on REMnux using the latest version of capa.
Steps to Reproduce
Execute capa -vv -b ghidra <mysample>
Expected behavior:
capa runs the ghidra backend and does -vv output.
Actual behavior:
breaks on a TypeError: expected string or bytes-like object (end of debug file)
Versions
capa 9.4.0
ghidra 12.1.2
python 3.12.3
Additional Information
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by running capa -vv -b ghidra <mysample> with the sample identified by SHA256, then compare the attached capabvv.txt and capab.txt outputs. Trace the TypeError: expected string or bytes-like object from the verbose Ghidra backend and verify that normal and verbose runs both complete successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cli, reverse-engineering
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100