mandiant / capa

The FLARE team's open-source tool to identify capabilities in executable files.
https://mandiant.github.io/capa/
Apache License 2.0
4.8k stars 557 forks source link

binja: optimize performance of name demangling #1610

Open williballenthin opened 1 year ago

williballenthin commented 1 year ago

https://github.com/mandiant/capa/blob/430f9da449cbd2c7142594f3bcf370cbcfee37d8/capa/features/extractors/binja/helpers.py#L46

tehami02 commented 1 year ago

@williballenthin I want to work on this.

williballenthin commented 1 year ago

this issue requires a license of Binary Ninja in order to triage and develop. do you have one?

you'll also need to work with @xusheng6 to clearly define the problem and propose a fix. i recall chatting with him about an opportunity for better performance but i don't remember the details.

tehami02 commented 1 year ago

@williballenthin No I dont have Binary Ninja License, maybe I should try some GFI's first.

williballenthin commented 1 year ago

i think #1607 and #1608 might be reasonable places to start.

tehami02 commented 1 year ago

@williballenthin Thanks for reference, I will try them.

tehami02 commented 1 year ago

@williballenthin I need little help, I actually forked capa repo and cloned it into my VSCode but I realised rules folder is empty and inaccessible on github in my forked version for some reason , so should I directly clone the original capa repo and later form a different branch ??

mr-tz commented 1 year ago

Are your issues addressed in https://github.com/mandiant/capa/blob/master/doc/installation.md#method-3-inspecting-the-capa-source-code? If not we should update the documentation to clarify.

tehami02 commented 1 year ago

@mr-tz Yeah, documentation says to clone the original capa repo ( this cmd - git clone --recurse-submodules https://github.com/mandiant/capa.git /local/path/to/src ) but I forked the repo and cloned it as usually thats how we do it.

xusheng6 commented 1 year ago

@mr-tz Yeah, documentation says to clone the original capa repo but I forked the repo and cloned it as usually thats how we do it.

Sounds like you are not cloning the submodules at the same time?

tehami02 commented 1 year ago

@xusheng6 do i need to clone sub modules seperately ??

xusheng6 commented 1 year ago

@xusheng6 do i need to clone sub modules seperately ??

Try run "git submodule update --init --recursive"

tehami02 commented 1 year ago

I m linking my forked version's rules folder link it says 404 not found which should not happen - https://github.com/tehami02/capa-rules

And this is my forked version link - https://github.com/tehami02/capa

xusheng6 commented 1 year ago

I m linking my forked version's rules folder link it says 404 not found which should not happen - https://github.com/tehami02/capa-rules

And this is my forked version link - https://github.com/tehami02/capa

Sorry I do not quite get it. Could you please explain what you are trying to do, how you attempted to do it, and what errors you are getting

tehami02 commented 1 year ago

@xusheng6 Basically I forked the capa repo but my fork does not contains files in rules folder as it contains in original one.

tehami02 commented 1 year ago

@xusheng6 my only doubt is should I clone the original capa repo ??

xusheng6 commented 1 year ago

@xusheng6 my only doubt is should I clone the original capa repo ??

Sorry I am not sure

tehami02 commented 1 year ago

@williballenthin @xusheng6 I saw pull requests of all contributors, they are using forked repo and their repo contains all files properly ( for example - https://github.com/linpeiyu164/capa/tree/master) repo of a contributor, but I forked capa repo once again from an another account ( link - https://github.com/testercse/capa) and found that it also has same problem folder like rules shows 404 error.

tehami02 commented 1 year ago

Sorry for all the chaos, for now I cloned capa repo directly and issue is sorted, I have all the files locally.

williballenthin commented 1 year ago

glad you got this figured out @tehami02!

im going to go back and hide a bunch of the comments above so that this thread appears on-topic and related to the name demangling issue. feel free to continue to ask questions and we're here to help.