mandiant / mandiant/capa

capa explorer: get stuck in the debugger

Open
#672 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug ida-explorer
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

Description

The explorer seem to get stuck when running it in the debugger, while it runs fine when the debugger is not running. This can make IDA crashing.

Steps to Reproduce
  1. Load 7d7b40fbe3d6bf1a8c04d9220b583acfe1c7a30fc91782f8e226b65f882f095c intro IDA
  2. Start the debugger
  3. Open the explorer plugin and press analyze
  4. You will notice it gets stuck with the following message: capa explorer...extracting features from function 0x13606BE (175 of 175). Pressing Cancel log error messages in the console. To continue using IDA (and close the explorer), you need to press Cancel maaany times
  5. If you don't cancel and wait for some minutes, it will eventually finish and show correct results

Screenshot 2021-07-01 at 15 53 45

Expected behavior:

  • The Cancel button, stop the analysis immediately and allow me to continue using IDA
  • capa explorer analysis is as fast in the debugger as outside of it

Actual behavior:

The explorer takes longer to run in the debugger and it is not possible to cancel.

Versions

master

Additional Information

I think it is not a very recent issue, as I think I had it before (so nothing that should block the release as it is probably not a regression).

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue in IDA with sample 7d7b40fbe3d6bf1a8c04d9220b583acfe1c7a30fc91782f8e226b65f882f095c, comparing capa explorer analysis with and without the debugger. Investigate the analysis state at the reported final function and repeated Cancel errors; done means cancellation immediately releases IDA and debugger-mode analysis completes without the reported delay.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.