Global pointer analysis causes infinite analysis loop

[williballenthin]

Version and Platform (required):

• Binary Ninja Version: 4.1.5902
• OS: Debian Linux
• OS Version: 6.9.10
• CPU Architecture: x86_64

Bug Description:
When analyzing the file with SHA256 0953cc3b77ed2974b09e3a00708f88de931d681e2d0cb64afbaf714610beabe6, Binary Ninja takes a really long time. At least 20 hours and 36GB RAM (before I killed it), despite the file being around 100KB.

Steps To Reproduce:
Load file using default options.

Expected Behavior:
Other binary analysis tools take a few seconds to disassemble and return (as an API user).

Screenshot:
After about an hour of analysis:

Binary:
https://github.com/mandiant/capa-testfiles/blob/master/0953cc3b77ed2974b09e3a00708f88de931d681e2d0cb64afbaf714610beabe6.exe_

Additional Details:
Note this is a .NET executable, so there's not actually that much native code to analyze.

[xusheng6]

Thanks for the report! We will look into it

[xusheng6]

The analysis gets stuck on sub_402258, which we should fix

[xusheng6]

The global pointer value analysis is causing the issue. A temporary workaround is to set analysis.globalPointerValueMinimumMajorityVotes to 3 or higher. We will have a more proper fix soon.

Also, @williballenthin is this a binary that capa needs to analyze during the CI? We can probably fix the issue in dev pretty soon, but the problem is that we are not going to get it on stable until the next release, and the capa CI is run against the stable release

[williballenthin]

@xusheng6 no, it's ok. I was just doing a comparative analysis among our supported backends and this stalled the pipeline.

I'll probably have a few other questions as I dig further into the results. Things are looking good though!

[xusheng6]

I added a setting analysis.limits.maxGlobalPointerValueUpdates, with a default value of 10. It means that the global pointer value can be updated a maximum of 10 times before we bail out. Since the global pointer is really meant to be a unanimous vote, if there are two or more values competing, then it is probably not global anyways. Setting or clearing a user global pointer value will reset this value, though, but the user value will be preferred if it is set