Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added a fix for an issue where certain binaries will timeout due to rpyc or DragodisError timeouts. #5

Open
wants to merge 9 commits into
base: master
Choose a base branch
from

Conversation

agski331
Copy link

@agski331 agski331 commented Jan 24, 2025

IDARemoteDisassembler times out when attempting to utilize dragodis on certain files.

IDARemoteDisassembler will timeout if it is used on a file with a larger than normal file loading time or autoanalysis time.
Example 5cc56bb9c934adde84e9e8725199c267d7313f25f83f97b60d0515d57887fe79 (Grandoreiro, although almost any delphi file will probably cause the issue).
This is because the ida_server.py is executed using IDA's -S parameter, which is handled after file loading and autoanalysis are complete. So if a file takes longer to autoanalyze / load than dragodis takes to run win_connect(), dragodis will not be able to connect to the IDA instance.

The following should fix the issue:

  • in IDARemoteDisassembler, up the retries in both win_connect() and unix_connect() to 20. This helps handle files with a large amount of sections where file loading may take more time than 10 retries.
  • In IDARemoteDisassembler.init(), set self._rpyc_config['sync_request_timeout'] = None. If this isnt done, the timeout will be an rpyc timeout on the idc.auto_wait() call instead of a dragodiserror timeout.
  • In IDARemoteDisassembler.init() Add a parameter called should_autoanalyze, which will instruct dragodis not to begin autoanalysis if set to False. This is useful for running scripts on files with long autoanalysis times where autoanalysis is not a requirement.
  • In IDARemoteDisassembler.start(), remove the line "self._idc.auto_wait()". Replace it with something like the following
    if self.__should_autoanalyze: logger.debug('Running autoanalysis.') self._idc.set_flag(self._idc.INF_GENFLAGS, self._idc.INFFL_AUTO, 1) self._idc.auto_wait() #For autoanalysis timeouts, hex rays likely needs to be contacted. else: logger.debug('Skipping autoanalysis.')
    This code enables autoanalysis and then runs idc.auto_wait() to await autoanalysis results.
  • In IDARemoteDisassembler.start(), add the parameter "-a" to the command arguments list. This parameter disables auto analysis by default.
  • By disabling auto analysis on IDA process start, IDA will only have to load the file before executing the ida_server.py. This allows the bridge to be properly initialized within the amount of retries that win_connect() allows. Then, once the bridge is initialized, autoanalysis can be restarted using the line "self._idc.set_flag(self._idc.INF_GENFLAGS, self._idc.INFFL_AUTO, 1)". idc.auto_wait() can then be called as normal to wait for autoanalysis to complete.
    of note: I did try adding a timeout to the autoanalysis feature, but there were issues with the ida_auto.auto_is_ok() function where it would constantly return that autoanalysis isnt running even when it is running.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants