From 7f3e35ee628b1daa38711e863428f344ffbca143 Mon Sep 17 00:00:00 2001 From: kamran ul haq Date: Sat, 10 Jan 2026 04:20:43 +0500 Subject: [PATCH] loader: gracefully handle ELF files with unsupported architectures (#2800) * loader: gracefully handle ELF files with unsupported architectures When analyzing ELF files with unsupported architectures (e.g., ARM64 variant), vivisect raises a generic Exception with message 'Unsupported Architecture: %d'. This was not caught by existing error handlers, causing capa to crash with an unfriendly error message. This change adds exception handling to detect the 'Unsupported Architecture' error message and convert it to a user-friendly CorruptFile exception, following the same pattern as the existing 'Couldn't convert rva' handler. The architecture number is extracted from the exception args and included in the error message to help users understand what went wrong. closes #2793 * loader: address review feedback for PR #2800 - Add e.args check to prevent IndexError when accessing exception arguments - Use error_msg variable instead of directly accessing e.args[0] - Update CHANGELOG to reference PR #2800 instead of issue #2793 Addresses feedback from @mike-hunhoff and gemini-code-assist bot * chore: move unsupported architecture bug fix to master (unreleased) section --- CHANGELOG.md | 1 + capa/loader.py | 11 +++++++++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7569ed52..b5455117 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -19,6 +19,7 @@ ### Bug Fixes - Fixed insecure deserialization vulnerability in YAML loading @0x1622 (#2770) +- loader: gracefully handle ELF files with unsupported architectures kamranulhaq2002@gmail.com #2800 ### capa Explorer Web diff --git a/capa/loader.py b/capa/loader.py index 448aeee0..c5446897 100644 --- a/capa/loader.py +++ b/capa/loader.py @@ -179,8 +179,15 @@ def get_workspace(path: Path, input_format: str, sigpaths: list[Path]): except Exception as e: # vivisect raises raw Exception instances, and we don't want # to do a subclass check via isinstance. - if type(e) is Exception and "Couldn't convert rva" in e.args[0]: - raise CorruptFile(e.args[0]) from e + if type(e) is Exception and e.args: + error_msg = str(e.args[0]) + + if "Couldn't convert rva" in error_msg: + raise CorruptFile(error_msg) from e + elif "Unsupported Architecture" in error_msg: + # Extract architecture number if available + arch_info = e.args[1] if len(e.args) > 1 else "unknown" + raise CorruptFile(f"Unsupported architecture: {arch_info}") from e raise viv_utils.flirt.register_flirt_signature_analyzers(vw, [str(s) for s in sigpaths])