Stabilize commons infrastructure for attack_surface_approximation compatibility - #8
Draft
krpandrei05 wants to merge 6 commits into
Draft
Stabilize commons infrastructure for attack_surface_approximation compatibility#8krpandrei05 wants to merge 6 commits into
krpandrei05 wants to merge 6 commits into
Conversation
Converted filenames to absolute paths before passing them to Docker. This ensures correct bind-mounting and avoids 400 Bad Request errors on Linux hosts. Fixes: #7 Signed-off-by: Andrei Carp <andrei.krp@gmail.com>
Added replacements for Ghidra-specific types like undefined8, bool, and uint in the decompiled code. This prevents ParseError when pycparser processes the main function. Signed-off-by: Andrei Carp <andrei.krp@gmail.com>
…acts Implemented fallback to Entry Point in decompile_function.py when 'main' is missing. Updated ghidra.py with a robust regex to strip all C-style comments and a cleaner for Ghidra-specific artifacts (processEntry, PTR_FUN_, stack references) to ensure compatibility with pycparser. Fixes: #9 Signed-off-by: Andrei Carp <andrei.krp@gmail.com>
krpandrei05
force-pushed
the
krpandrei/fix/attack-surface-approximation-support
branch
from
May 10, 2026 00:46
111731a to
20b423d
Compare
Updated pyproject.toml to use a fixed Python version (3.12.7) and ensured all core dependencies are pinned to exact versions for consistency across the CRS environment. Signed-off-by: Andrei Carp <andrei.krp@gmail.com>
razvand
requested changes
May 18, 2026
razvand
left a comment
razvand
left a comment
Contributor
There was a problem hiding this comment.
Use a blank line between Fixes and the Signed-off-by message.
Limit commit messages to 72 characters.
Start commit title with capital, i.e. instead of support stripped binaries ..., use Support stripped binaries ...
Use Python instead of python.
Added substitutions for stdint.h exact-width types (uint8_t..uint64_t, int8_t..int64_t), POSIX public types (ssize_t, pid_t, off_t, uid_t, gid_t, mode_t, time_t, socklen_t) and their __ variants, preserving correct replacement order to avoid partial-match corruption (e.g. ssize_t before size_t, uint32_t before uint). Also broadened PTR_ pattern from PTR_FUN_* to PTR_* to cover global pointer artifacts such as PTR_stdin_ generated by Ghidra for standard streams. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…d glibc macro aliases Removed duplicate entries from STDIN list. Added missing indicators: getc/getchar/getline/scanf (STDIN), fopen/open/openat (FILES), connect/send/sendto/sendmsg (NETWORKING), secure_getenv (ENV). Added GLIBC_MACRO_EXPANSIONS dict and _with_glibc_aliases() to automatically include _IO_getc/_IO_getchar alongside their public macro names, covering glibc binaries where getc expands at compile time to _IO_getc in the PLT. Signed-off-by: Andrei Carp <andrei.krp@gmail.com>
There was a problem hiding this comment.
Pull request overview
This PR aims to improve compatibility/stability when commons is used by attack_surface_approximation, primarily by ensuring Docker bind mounts use absolute host paths and by making Ghidra-based decompilation more resilient for stripped binaries / irregular decompiler output.
Changes:
- Convert analyzed binary filenames to absolute paths before passing them into Docker volume mounts.
- Expand/adjust static input-stream indicators (including glibc macro expansion aliases and additional sources like env/network/file open calls).
- Improve Ghidra headless decompilation behavior (fallback function selection + additional decompiled-code cleanup) and pin runtime dependencies.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| pyproject.toml | Pins Python and key dependencies to specific versions. |
| commons/input_streams.py | Adds glibc macro alias expansion and broadens input source indicator lists. |
| commons/ghidra/scripts/decompile_function.py | Adds fallback logic to select a function even when the requested symbol isn’t found. |
| commons/ghidra/ghidra.py | Uses absolute paths for Docker mounts and expands decompiled-code normalization/sanitization. |
Suppressed comments (2)
commons/ghidra/ghidra.py:131
__replace_longsis annotated as returningNone, but it returns a transformed string and is used as such by__process_decompiled_code. The return type should bestr.
def __replace_longs(self, code: str) -> None:
commons/ghidra/ghidra.py:175
__replace_double_linesis annotated as returningNone, but it returns a transformed string and is used as such by__process_decompiled_code. The return type should bestr.
def __replace_double_lines(self, code: str) -> None:
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+10
to
+12
| python = "==3.12.7" | ||
| pwntools = "==4.15.0" | ||
| docker = "==7.1.0" |
Comment on lines
+39
to
+43
| if not function: | ||
| entry_points = program.getSymbolTable().getExternalSymbols("entry") | ||
| # If still nothing, pick the absolute first function in the manager | ||
| if not function: | ||
| function = program.getFunctionManager().getFunctions(True).next() |
|
|
||
| return code | ||
|
|
||
| def __replace_undefs(self, code: str) -> None: |
Comment on lines
+167
to
+173
| def __replace_ghidra_artifacts(self, code: str) -> str: | ||
| # Remove Ghidra specific keywords and formatting that break pycparser | ||
| code = code.replace("processEntry", "") | ||
| code = re.sub(r'PTR_\w+', '0', code) | ||
| code = re.sub(r'FUN_[0-9a-f]+', '0', code) | ||
| code = re.sub(r'&stack0x[0-9a-f]+', '0', code) | ||
| return code |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Converted filenames to absolute paths before passing them to Docker. This ensures correct bind-mounting and avoids 400 Bad Request errors on Linux hosts.
Fixes: #7, Fixes: #9