loader: gracefully handle ELF files with unsupported architectures by kami922 · Pull Request #2800 · mandiant/capa

kami922 · 2025-12-28T19:50:23Z

Summary

Fixes #2793 - capa crashes when analyzing ELF files with unsupported architectures

Problem

When vivisect encounters an ELF file with an unsupported architecture (e.g., ARM64 variant), it raises a generic Exception with message 'Unsupported Architecture: %d\n', 183. This was not caught by existing error handlers in capa/loader.py, causing capa to crash with an unfriendly traceback.

Solution

Added exception handling in get_workspace() to detect "Unsupported Architecture" error messages and convert them to user-friendly CorruptFile exceptions, following the same pattern as the existing "Couldn't convert rva" handler.

Changes

capa/loader.py: Added exception handler for "Unsupported Architecture" errors with architecture number extraction
CHANGELOG.md: Added bug fix entry

Checklist

CHANGELOG updated
No new tests needed (follows existing error handling pattern, CI will validate)
No documentation update needed (internal error handling improvement)

closes #2793

When analyzing ELF files with unsupported architectures (e.g., ARM64 variant), vivisect raises a generic Exception with message 'Unsupported Architecture: %d'. This was not caught by existing error handlers, causing capa to crash with an unfriendly error message. This change adds exception handling to detect the 'Unsupported Architecture' error message and convert it to a user-friendly CorruptFile exception, following the same pattern as the existing 'Couldn't convert rva' handler. The architecture number is extracted from the exception args and included in the error message to help users understand what went wrong. closes mandiant#2793

gemini-code-assist · 2025-12-28T19:50:34Z

Summary of Changes

Hello @kami922, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the robustness of capa by preventing crashes when it encounters ELF files with architectures not supported by its underlying vivisect library. Instead of a generic traceback, users will now receive a clear CorruptFile exception, indicating the nature of the problem and, if possible, the unsupported architecture.

Highlights

Bug Fix: Resolves a crash in capa that occurred when analyzing ELF files with unsupported architectures, such as certain ARM64 variants.
Improved Error Handling: Introduced specific exception handling within capa/loader.py to catch generic vivisect exceptions related to 'Unsupported Architecture' and convert them into more user-friendly CorruptFile exceptions.
Architecture Information Extraction: The updated error handling now attempts to extract and include the specific unsupported architecture number in the CorruptFile exception message, providing more context to the user.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request addresses a crash when analyzing ELF files with unsupported architectures by adding specific exception handling for vivisect's 'Unsupported Architecture' error. The approach of converting this to a more user-friendly CorruptFile exception is good.

My review includes a suggestion to refactor the exception handling logic in capa/loader.py to make it more robust and prevent potential IndexError crashes within the except block, improving the overall safety of the error handling.

gemini-code-assist · 2025-12-28T19:51:40Z

+        if type(e) is Exception:
+            error_msg = str(e.args[0]) if e.args else str(e)
+
+            if "Couldn't convert rva" in error_msg:
+                raise CorruptFile(e.args[0]) from e
+            elif "Unsupported Architecture" in error_msg:
+                # Extract architecture number if available
+                arch_info = e.args[1] if len(e.args) > 1 else "unknown"
+                raise CorruptFile(f"Unsupported architecture: {arch_info}") from e


This refactoring introduces a potential IndexError. If an exception occurs where e.args is empty, but str(e) contains one of the target error strings (e.g., "Couldn't convert rva"), the code will attempt to access e.args[0] or e.args[1], which will fail.

To make the error handling more robust and cleaner, I suggest checking for e.args upfront. This ensures that you only try to access exception arguments when they exist, preventing a crash in the exception handler. The original exception will be re-raised if e.args is empty, which is the correct fallback behavior.

Suggested change

if type(e) is Exception:

error_msg = str(e.args[0]) if e.args else str(e)

if "Couldn't convert rva" in error_msg:

raise CorruptFile(e.args[0]) from e

elif "Unsupported Architecture" in error_msg:

# Extract architecture number if available

arch_info = e.args[1] if len(e.args) > 1 else "unknown"

raise CorruptFile(f"Unsupported architecture: {arch_info}") from e

if type(e) is Exception and e.args:

error_msg = str(e.args[0])

if "Couldn't convert rva" in error_msg:

raise CorruptFile(e.args[0]) from e

elif "Unsupported Architecture" in error_msg:

# Extract architecture number if available

arch_info = e.args[1] if len(e.args) > 1 else "unknown"

raise CorruptFile(f"Unsupported architecture: {arch_info}") from e

@kami922 please address this change here.

mike-hunhoff

Thank you @kami922 . Please see my review and address the suggested changes.

mike-hunhoff · 2025-12-29T16:59:34Z


 ### Bug Fixes

+- loader: gracefully handle ELF files with unsupported architectures @kami922 #2793


Please move this to the unreleased section and change the issue number to the number of this PR.

@mike-hunhoff

- Add e.args check to prevent IndexError when accessing exception arguments - Use error_msg variable instead of directly accessing e.args[0] - Update CHANGELOG to reference PR mandiant#2800 instead of issue mandiant#2793 Addresses feedback from @mike-hunhoff and gemini-code-assist bot

kami922 · 2025-12-31T15:53:33Z

@mike-hunhoff Good day i made the changes as request, one ci was skipped i dont know why tho can you please review thank you!

mike-hunhoff

Thanks @kami922 , one last change for you to review. Also, please sync with the master branch.

mike-hunhoff · 2026-01-06T16:45:41Z


 ### Bug Fixes

+- loader: gracefully handle ELF files with unsupported architectures kamranulhaq2002@gmail.com #2800


Please move this to the unreleased section of the CHANGELOG, see

capa/CHANGELOG.md

Line 3 in dc47de1

## master (unreleased)

…ection

kami922 · 2026-01-08T19:16:08Z

@mike-hunhoff can i get an update on this one please? Lemme know if there are any more changes to be made

mike-hunhoff · 2026-01-09T23:20:25Z

@mike-hunhoff can i get an update on this one please? Lemme know if there are any more changes to be made

LGTM, thank you!

- CHANGELOG.md: kept both PR mandiant#2800, mandiant#2799, and mandiant#2802 entries - tests/fixtures.py: resolved duplicate and formatting conflicts - .github/workflows/tests.yml: resolved formatting conflict - tests/data: accepted submodule deletion

gemini-code-assist Bot reviewed Dec 28, 2025

View reviewed changes

mike-hunhoff requested changes Dec 29, 2025

View reviewed changes

kami922 requested a review from mike-hunhoff December 31, 2025 15:54

Merge branch 'master' into fix-2793-unsupported-arch

1d9eb90

mike-hunhoff requested changes Jan 6, 2026

View reviewed changes

kami922 added 2 commits January 6, 2026 22:57

chore: move unsupported architecture bug fix to master (unreleased) s…

b21af7a

…ection

Merge branch 'master' into fix-2793-unsupported-arch

418c8b4

mike-hunhoff approved these changes Jan 9, 2026

View reviewed changes

mike-hunhoff merged commit 7f3e35e into mandiant:master Jan 9, 2026
28 checks passed

Navigation Menu

Uh oh!

loader: gracefully handle ELF files with unsupported architectures - #2800

loader: gracefully handle ELF files with unsupported architectures#2800
mike-hunhoff merged 5 commits into
mandiant:masterfrom
kami922:fix-2793-unsupported-arch

kami922 commented Dec 28, 2025

Uh oh!

gemini-code-assist Bot commented Dec 28, 2025

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Dec 28, 2025

Uh oh!

mike-hunhoff Dec 29, 2025

Uh oh!

mike-hunhoff left a comment

Uh oh!

mike-hunhoff Dec 29, 2025

Uh oh!

kami922 commented Dec 31, 2025

Uh oh!

mike-hunhoff left a comment

Uh oh!

mike-hunhoff Jan 6, 2026

Uh oh!

kami922 commented Jan 8, 2026

Uh oh!

mike-hunhoff commented Jan 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		### Bug Fixes

		- loader: gracefully handle ELF files with unsupported architectures @kami922 #2793

Uh oh!

Conversation

kami922 commented Dec 28, 2025

Summary

Problem

Solution

Changes

Checklist

Uh oh!

gemini-code-assist Bot commented Dec 28, 2025

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Dec 28, 2025

Choose a reason for hiding this comment

Uh oh!

mike-hunhoff Dec 29, 2025

Choose a reason for hiding this comment

Uh oh!

mike-hunhoff left a comment

Choose a reason for hiding this comment

Uh oh!

mike-hunhoff Dec 29, 2025

Choose a reason for hiding this comment

Uh oh!

kami922 commented Dec 31, 2025

Uh oh!

mike-hunhoff left a comment

Choose a reason for hiding this comment

Uh oh!

mike-hunhoff Jan 6, 2026

Choose a reason for hiding this comment

Uh oh!

kami922 commented Jan 8, 2026

Uh oh!

mike-hunhoff commented Jan 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants