Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

BinExport2: better handle weird expression trees #2531

Merged
merged 5 commits into from
Dec 9, 2024
Merged

BinExport2: better handle weird expression trees #2531

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
7d034ac
main: use two lines when warning about stack trace
williballenthin Dec 9, 2024
bf27586
inspect-binexport2: render aarch64 vector element sizes
williballenthin Dec 9, 2024
37900d0
inspect-binexport: better handle MSRs exported by Ghidra
williballenthin Dec 9, 2024
b72fa47
changelog
williballenthin Dec 9, 2024
f1c0090
BinExport2: better handle weird Ghidra expressions
williballenthin Dec 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion capa/main.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -198,7 +198,7 @@ def simple_message_exception_handler(
else:
print(
f"Unexpected exception raised: {exctype}. Please run capa in debug mode (-d/--debug) "
+ "to see the stack trace. Please also report your issue on the capa GitHub page so we "
+ "to see the stack trace.\nPlease also report your issue on the capa GitHub page so we "
+ "can improve the code! (https://github.com/mandiant/capa/issues)",
file=sys.stderr,
)
Expand Down
35 changes: 31 additions & 4 deletions scripts/inspect-binexport2.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,8 +81,21 @@ def _render_expression_tree(

if expression.type == BinExport2.Expression.REGISTER:
o.write(expression.symbol)
assert len(children_tree_indexes) == 0
return
assert len(children_tree_indexes) <= 1

if len(children_tree_indexes) == 0:
return
elif len(children_tree_indexes) == 1:
# like for aarch64 with vector instructions, indicating vector data size:
#
# FADD V0.4S, V1.4S, V2.4S
#
# see: https://github.com/mandiant/capa/issues/2528
child_index = children_tree_indexes[0]
_render_expression_tree(be2, operand, expression_tree, child_index, o)
return
else:
raise NotImplementedError(len(children_tree_indexes))

elif expression.type == BinExport2.Expression.SYMBOL:
o.write(expression.symbol)
Expand All @@ -106,8 +119,22 @@ def _render_expression_tree(

elif expression.type == BinExport2.Expression.IMMEDIATE_INT:
o.write(f"0x{expression.immediate:X}")
assert len(children_tree_indexes) == 0
return
assert len(children_tree_indexes) <= 1

if len(children_tree_indexes) == 0:
return
elif len(children_tree_indexes) == 1:
# the ghidra exporter can produce some weird expressions,
# particularly for MSRs, like for:
#
# sreg(3, 0, c.0, c.4, 4)
#
# see: https://github.com/mandiant/capa/issues/2530
child_index = children_tree_indexes[0]
_render_expression_tree(be2, operand, expression_tree, child_index, o)
return
else:
raise NotImplementedError(len(children_tree_indexes))

elif expression.type == BinExport2.Expression.SIZE_PREFIX:
# like: b4
Expand Down
Loading