Mike Hunhoff

Results 117 comments of Mike Hunhoff

> There was a `TypeRef` table infinite loop issue when dotnet parser parsing a crafted dotnet sample with ref index refer to each other: > > ![problematic-dotnet](https://private-user-images.githubusercontent.com/4924242/318694461-7c68d84f-c76b-4c7b-a5ca-6c52b3c3925e.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MTMxOTc2NTIsIm5iZiI6MTcxMzE5NzM1MiwicGF0aCI6Ii80OTI0MjQyLzMxODY5NDQ2MS03YzY4ZDg0Zi1jNzZiLTRjN2ItYTVjYS02YzUyYjNjMzkyNWUucG5nP1gtQW16LUFsZ29yaXRobT1BV1M0LUhNQUMtU0hBMjU2JlgtQW16LUNyZWRlbnRpYWw9QUtJQVZDT0RZTFNBNTNQUUs0WkElMkYyMDI0MDQxNSUyRnVzLWVhc3QtMSUyRnMzJTJGYXdzNF9yZXF1ZXN0JlgtQW16LURhdGU9MjAyNDA0MTVUMTYwOTEyWiZYLUFtei1FeHBpcmVzPTMwMCZYLUFtei1TaWduYXR1cmU9NDI5ODk4M2I0N2MwYWJkOTA4Yjk0MDM2ZWRiNDUyMjQ3ZDI5ZjUzMGFkYTc1MGE5MGVmNTc0ZjY5MmY1YWY0NSZYLUFtei1TaWduZWRIZWFkZXJzPWhvc3QmYWN0b3JfaWQ9MCZrZXlfaWQ9MCZyZXBvX2lkPTAifQ.vLb_k65phIjWBydt-_f45T6Bhoudz32101oUr2BPtEg)   Let me know...

Done, thank you @danieldsouza13 ! Let us know if you have any questions.

Thanks for reaching out @Atlas-64 . This issue has already been assigned to someone else. @danieldsouza13 are you still working on this? If so, please provide a status update. If...

Removing @danieldsouza13 due to inactivity. @Atlas-64 I've assigned this issue to you. Please ask any questions here otherwise I'll keep an eye out for your PR.

> sorry for the delay , I finally got the time to go through the code right now so basically on going through capa_ghidra.py, where it uses askChoices to get...

> I also had a question about what set_plate_commen() and set_pre_comment() exactly do within capa_explorer.py @mike-hunhoff These helper functions set `ghidra.program.model.listing.CodeUnit.PLATE_COMMENT` and `ghidra.program.model.listing.CodeUnit.PRE_COMMENT` comments using Ghidra's flat program APIs [setPlateComment](https://ghidra.re/ghidra_docs/api/ghidra/program/flatapi/FlatProgramAPI.html#setPlateComment(ghidra.program.model.address.Address,java.lang.String))...

Thank you for opening, great idea! With the latest changes to Ghidrathon we can download the pre-built extension and remove the Gradle build steps from our CI workflow.

Thank you for reaching out @psahithireddy - I've assigned this issue to you. The goal here is to update [capa's existing Ghidra test workflow](https://github.com/mandiant/capa/blob/c6b43d74927b8374e5970508d530e806acddd576/.github/workflows/tests.yml#L147-L203) to leverage the [simplified Ghidrathon v4...

The [Ghidrathon-v4.0.0.zip file](https://github.com/mandiant/Ghidrathon/releases/tag/v4.0.0) contains three files: ![Screenshot 2024-02-23 1 53 01 PM](https://github.com/mandiant/capa/assets/42192796/43fd2d23-1f85-4f97-93bb-7857a4d19c86) `requirements.txt` and `ghidrathon_configure.py` can be used as described Ghidrathon's installation steps. The embedded `Ghidrathon-v4.0.0.zip` should be extracted directly...