Description
When using ida as backend, analyzing any file with an existing database (packed or unpacked) will cause capa to exit with return code 1, without any logs or cleanup.
I tried ida -R <file>, and it says Switch '-R' can be used only when loading a new file, which I believe is the reason behind failed open_database call.
I can confirm the error is introduced in 0686305 , which passes switch -R to idapro.open_database. idapro.open_database will directly cause exit_group(1) instead of returning an error code.
Steps to Reproduce
- Open
tests/data/009c2377b67997b0da1579f4bbc822c1.exe_ in IDA
- Save database (produce
.i64 file in same directory) and exit IDA
- Run
capa -b ida tests/data/009c2377b67997b0da1579f4bbc822c1.exe_ -d
Note, in current version of capa (commit 6579e01), because of the lack of idapro.close_database, running capa -b <file> will cause idapro to leave behind unpacked database files (*.id0 *.id1 *.id2 *.nam *.til); When trying to open_database against the file again, it will pick up the unpacked databases and cause the same issue.
Expected behavior:
capa displays analyze report correctly.
Actual behavior:
capa exits with return code 1 after capa.loader: idalib: opening database... | loader.py:396. Any code after idapro.open_database is not executed.
Versions
capa: commit 6579e01
IDA Pro: Version 9.3.260213.91fc47de Linux x86_64 (64-bit address size)
Python: 3.13.5
OS: Arch Linux
Additional Information
Related issue: #2808
I'd be happy to implement the fix once we decide on a solution.
Description
When using
idaas backend, analyzing any file with an existing database (packed or unpacked) will cause capa to exit with return code 1, without any logs or cleanup.I tried
ida -R <file>, and it saysSwitch '-R' can be used only when loading a new file, which I believe is the reason behind failedopen_databasecall.I can confirm the error is introduced in 0686305 , which passes switch
-Rtoidapro.open_database.idapro.open_databasewill directly causeexit_group(1)instead of returning an error code.Steps to Reproduce
tests/data/009c2377b67997b0da1579f4bbc822c1.exe_in IDA.i64file in same directory) and exit IDAcapa -b ida tests/data/009c2377b67997b0da1579f4bbc822c1.exe_ -dNote, in current version of capa (commit 6579e01), because of the lack of
idapro.close_database, runningcapa -b <file>will cause idapro to leave behind unpacked database files (*.id0 *.id1 *.id2 *.nam *.til); When trying toopen_databaseagainst the file again, it will pick up the unpacked databases and cause the same issue.Expected behavior:
capa displays analyze report correctly.
Actual behavior:
capa exits with return code 1 after
capa.loader: idalib: opening database... | loader.py:396. Any code afteridapro.open_databaseis not executed.Versions
capa: commit 6579e01
IDA Pro: Version 9.3.260213.91fc47de Linux x86_64 (64-bit address size)
Python: 3.13.5
OS: Arch Linux
Additional Information
Related issue: #2808
I'd be happy to implement the fix once we decide on a solution.