mandiant / capa

The FLARE team's open-source tool to identify capabilities in executable files.
Apache License 2.0
3.99k stars 499 forks source link

Fix BinExport's "tight loop" feature extraction. #2050

Closed larchchen closed 2 months ago

larchchen commented 2 months ago

idx.target_edges_by_basic_block_index[basic_block_index] is of type List[Edges]. The index basic_block_index was definitely not an element.

Checklist

mr-tz commented 2 months ago

thanks!

mr-tz commented 2 months ago

something seems off here, investigating that this reports functions like this as having a tight loop:

image

williballenthin commented 2 months ago

bummer that mypy didn't catch this, oh well

williballenthin commented 2 months ago

After some investigating, mypy correct determines that the list contains edge instances and the index is an int, but doesn't complain that "an int will never be found in a list of edges". Perhaps that sort of lint has too many false positives (since objects might overload their __in__ methods???) or something. Too bad.

williballenthin commented 2 months ago

something seems off here, investigating that this reports functions like this as having a tight loop:

There was a bug in the second line of the patch, it should be:

image

target_edges contains a list of all edges that terminate at the given basic block. So we need to inspect the list for edges that also source from that block.

I've pushed a fix to the branch.