Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ghidra: Basic Block Feature Extraction #1637

Merged
merged 20 commits into from
Jul 17, 2023

Conversation

colton-gabertan
Copy link
Collaborator

Checklist

  • No CHANGELOG update needed
  • No new tests needed
  • No documentation update needed

Implements #1510 - Ghidra: Basic Block Feature Extraction

Copy link
Collaborator

@mike-hunhoff mike-hunhoff left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great progress @colton-gabertan ! It's cool to see you digging deeper into Ghidra's scripting API! I've left comments for your review.

capa/features/extractors/ghidra/basicblock.py Outdated Show resolved Hide resolved
def get_printable_len(op: ghidra.program.model.scalar.Scalar) -> int:
"""Return string length if all operand bytes are ascii or utf16-le printable"""
op_bit_len = op.bitLength()
op_val = op.getValue()
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since we are dealing with printable characters, should we be using getUnsignedValue here instead?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I didn't want it to ever return a NoneType, and the &'s handle the conversion to an unsigned int. I was thinking that the NoneTypes would cause crashes.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That makes sense - I'm not seeing anywhere in Ghidra's documentation where getUnsignedValue may return None? Did you find this was the case during testing?

capa/features/extractors/ghidra/basicblock.py Outdated Show resolved Hide resolved
capa/features/extractors/ghidra/basicblock.py Outdated Show resolved Hide resolved
capa/features/extractors/ghidra/basicblock.py Outdated Show resolved Hide resolved
capa/features/extractors/ghidra/basicblock.py Outdated Show resolved Hide resolved
capa/features/extractors/ghidra/basicblock.py Show resolved Hide resolved
@mike-hunhoff mike-hunhoff added ghidra Related to Ghidra integration gsoc Work related to Google Summer of Code project. labels Jul 14, 2023
Copy link
Collaborator

@mike-hunhoff mike-hunhoff left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

great work @colton-gabertan ! LGTM 🚀

def get_printable_len(op: ghidra.program.model.scalar.Scalar) -> int:
"""Return string length if all operand bytes are ascii or utf16-le printable"""
op_bit_len = op.bitLength()
op_val = op.getValue()
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That makes sense - I'm not seeing anywhere in Ghidra's documentation where getUnsignedValue may return None? Did you find this was the case during testing?

@mike-hunhoff mike-hunhoff merged commit 6fa7f24 into backend-ghidra Jul 17, 2023
17 checks passed
@mike-hunhoff mike-hunhoff deleted the ghidra-bb-feats-1510 branch July 17, 2023 15:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
ghidra Related to Ghidra integration gsoc Work related to Google Summer of Code project.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants