Willi Ballenthin

idalib: search for desktop entry in file on Desktop

1

 not found in ~/.local/share/applications but on the desktop directly

binary ninja: optimize feature extraction

15

During some initial profiling, I'm finding that the Binary Ninja backend is substantially slower than vivisect or IDA. This thread will enumerate all the things we discover. It might include:...

triage binary ninja backend failures

11

from capa-testfiles, these files fail to process today: ``` failures for binja: - 0761142efbda6c4b1e801223de723578.dll_ - 1038a23daad86042c66bfe6c9d052d27048de9653bde5750dc0f240c792d9ac8.elf_ - 112f9f0e8d349858a80dd8c14190e620.exe_ - 253309d8b3675d3cc61d4bf23aa15d4b.dll_ - 2dae11cc5f86f5399b560b8837c26274b7e09431deed669b0844fef44e917915.exe_ - 2f7f5fb5de175e770d7eae87666f9831.elf_ - 3b13b6f1d7cd14dc4a097a12e2e505c0a4cff495262261e2bfc991df238b9b04.dll_ - 4122acca2f9ea98fc3f3ad040688e4ce.exe_ - 44d40faf3f1fe4ed969befab7afcd2f0.exe_...


does capa run on pypy? is it faster?

1

research this

dynamically indent comments in decompiler view

4

**Is your feature request related to a problem? Please describe.** The decompiler view emits comments at a static indent level. When code is nested at various levels, such as with...

migrate Ghidra backend from Ghidrathon to PyGhidra

12

Ghidra 11.3 was recently released with the built-in PyGhidra Python API bindings: https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_11.3_build/Ghidra/Configurations/Public_Release/src/global/docs/WhatsNew.md#pyghidra We should consider migrating capa's Ghidra backend from Ghidrathon, which is a third-party binding that requires installation...

This PR adds a script that displays the layout of a program: - metadata - sections - libraries - list of functions, each with - xrefs to the function -...

bump the linux standalone build to use python 3.13

6

we're currently on 3.12, but 3.13 was released Oct 2024