capa icon indicating copy to clipboard operation
capa copied to clipboard

capa explorer: get stuck in the debugger

Open Ana06 opened this issue 4 years ago • 1 comments

Description

The explorer seem to get stuck when running it in the debugger, while it runs fine when the debugger is not running. This can make IDA crashing.

Steps to Reproduce

  1. Load 7d7b40fbe3d6bf1a8c04d9220b583acfe1c7a30fc91782f8e226b65f882f095c intro IDA
  2. Start the debugger
  3. Open the explorer plugin and press analyze
  4. You will notice it gets stuck with the following message: capa explorer...extracting features from function 0x13606BE (175 of 175). Pressing Cancel log error messages in the console. To continue using IDA (and close the explorer), you need to press Cancel maaany times
  5. If you don't cancel and wait for some minutes, it will eventually finish and show correct results

Screenshot 2021-07-01 at 15 53 45

Expected behavior:

  • The Cancel button, stop the analysis immediately and allow me to continue using IDA
  • capa explorer analysis is as fast in the debugger as outside of it

Actual behavior:

The explorer takes longer to run in the debugger and it is not possible to cancel.

Versions

master

Additional Information

I think it is not a very recent issue, as I think I had it before (so nothing that should block the release as it is probably not a regression).

Ana06 avatar Jul 01 '21 14:07 Ana06

I recently encountered this issue with a sample that contained 18k+ functions (without debugger running). Therefore, I'm unsure whether this issue is correlated to the debugger or is instead a resource issue? More investigation to come.

mike-hunhoff avatar Jul 29 '21 22:07 mike-hunhoff

Can you please provide he file. I want to look into this issue.

manasghandat avatar Mar 07 '23 13:03 manasghandat