ida: get_bytes may be padded with 0xFF for uninit'd bytes

Open Beginner friendly
#3,104 4 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
1/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
python

Research direction

Start in capa/features/extractors/ida/helpers.py at read_bytes_at, especially lines 237-247, and review how get_bytes handles uninitialized bytes. Update the call so invalid bytes stop the returned buffer instead of adding trailing 0xFF values. Done means encountered byte features no longer contain trailing bytes from uninitialized regions.

Written by the indexing model from the issue text.

Description

breaking-change bug ida
Image Image

otherwise, get_bytes will insert the byte 0xFF for uninitialized bytes, and it will return a buffer of exactly size.

for IDA extractor read_bytes_at, this probably isn't what we want, because our encountered byte features will have extra trailing junk at the end.

https://github.com/mandiant/capa/blob/2c12cbb4854265e013f03c42d1bb1404f198adc6/capa/features/extractors/ida/helpers.py#L237-L247

instead, we should pass gmb_flags=0 so that get_bytes stops at the first invalid byte.

alternatively, we could use get_bytes_and_mask and manually trim from the right, but i think this is likely to be much slower and harder to get right.

Dominant language
Python
Stars
6.2k
Forks
727
Avg merge
11d 11h
Merged PRs (30d)
7

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from mandiant/capa

All issues in mandiant/capa

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.