KeyError: 'r_info_sym' #2553
Description
Description
Hi, i found a bug on capa-v8.0.1-linux. The bug is:
KeyError: 'r_info_sym'
[PYI-979755:ERROR] Failed to execute script 'main' due to unhandled exception!
Steps to Reproduce
Just run ./capa-v8.0.1-linux --rules rules -d (which ls)
Expected behavior:
It should works and with exit code status 0.
Actual behavior:
It prints error: KeyError: 'r_info_sym' and exit code status 1.
Versions
./capa-v8.0.1-linux --version
capa-v8.0.1-linux 8.0.1
file ./capa-v8.0.1-linux
./capa-v8.0.1-linux: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=8485f6953c06d12b9865185ba3466fdbf9b4a65c, for GNU/Linux 2.6.32, stripped
cat /etc/os-release
NAME="Fedora Linux"
VERSION="40 (Cloud Edition)"
ID=fedora
VERSION_ID=40
VERSION_CODENAME=""
PLATFORM_ID="platform:f40"
PRETTY_NAME="Fedora Linux 40 (Cloud Edition)"
ANSI_COLOR="0;38;2;60;110;180"
LOGO=fedora-logo-icon
CPE_NAME="cpe:/o:fedoraproject:fedora:40"
HOME_URL="https://fedoraproject.org/"
DOCUMENTATION_URL="https://docs.fedoraproject.org/en-US/fedora/f40/system-administrators-guide/"
SUPPORT_URL="https://ask.fedoraproject.org/"
BUG_REPORT_URL="https://bugzilla.redhat.com/"
REDHAT_BUGZILLA_PRODUCT="Fedora"
REDHAT_BUGZILLA_PRODUCT_VERSION=40
REDHAT_SUPPORT_PRODUCT="Fedora"
REDHAT_SUPPORT_PRODUCT_VERSION=40
SUPPORT_END=2025-05-13
VARIANT="Cloud Edition"
VARIANT_ID=cloud
Additional Information
I have tried to edit the code in capa/features/extractors/elffile.py at line 124 and 125 to be like this
from:
124 if relocation["r_info_sym"] not in symbol_names:
125 continue
to:
124 #if relocation["r_info_sym"] not in symbol_names:
125 #continue
126 try:
127 if relocation["r_info_sym"] not in symbol_names:
128 continue
129 except KeyError:
130 continue
Then i install the local source code using pip install -e ., then run capa --rules rules (which ls), it exits with exit code status 0.
Should these codes added in the next release?
Is your bug report related to capa rules (for example a false positive)?
No.
Have you checked that your issue isn't already filed?
No, i have checked with this filter "is:issue r_info_sym" and no results matched.
Have you read capa's Code of Conduct?
Yes.
Have you read capa's CONTRIBUTING guide?
No, just see it.