ida: get_bytes may be padded with 0xFF for uninit'd bytes
Nobody has claimed this yet.
Assessment
- Difficulty
- 1/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- python
- Domain
- reverse-engineering
Research direction
Start in capa/features/extractors/ida/helpers.py at read_bytes_at, especially lines 237-247, and review how get_bytes handles uninitialized bytes. Update the call so invalid bytes stop the returned buffer instead of adding trailing 0xFF values. Done means encountered byte features no longer contain trailing bytes from uninitialized regions.
Written by the indexing model from the issue text.
Description
otherwise, get_bytes will insert the byte 0xFF for uninitialized bytes, and it will return a buffer of exactly size.
for IDA extractor read_bytes_at, this probably isn't what we want, because our encountered byte features will have extra trailing junk at the end.
instead, we should pass gmb_flags=0 so that get_bytes stops at the first invalid byte.
alternatively, we could use get_bytes_and_mask and manually trim from the right, but i think this is likely to be much slower and harder to get right.
- Dominant language
- Python
- Stars
- 6.2k
- Forks
- 727
- Avg merge
- 11d 11h
- Merged PRs (30d)
- 7
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from mandiant/capa
-
enhancement gsoc tree-sitter
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
bug cape
Difficulty 1/5 Under an hour Newbie friendliness 78/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100