binja unit test failing because an expected function is not created by the auto analysis

[xusheng6]

The binja unit test is now failing: https://github.com/mandiant/capa/actions/runs/12018561216/job/33504909578#step:7:222

And the reason is the stable 4.2 binja is not creating a function at 0x14004b4f0 for the sample al-khaser_x64.exe_

[xusheng6]

I will create a workaround for it since a proper fix will only come in the next stable release

[xusheng6]

@williballenthin I checked the code and did not find a good way to workaround this. Can we disable the al-khaser_x64.exe test for binja backend? Since even if we have a proper fix for it soon, it would not be available in the stable until the next stable release

[xusheng6]

@williballenthin please add binary-ninja tag on this

[mr-tz]

Could we manually create the function like for vivisect?

capa/tests/fixtures.py

Lines 119 to 128 in c85be8d

	def fixup_viv(path: Path, extractor):
	"""
	vivisect fixups to overcome differences between backends
	"""
	if "3b13b" in path.name:
	# vivisect only recognizes calling thunk function at 0x10001573
	extractor.vw.makeFunction(0x10006860)
	if "294b8d" in path.name:
	# see vivisect/#561
	extractor.vw.makeFunction(0x404970)

Otherwise, we can just skip/xfail the test with the missing function.

[xusheng6]

Could we manually create the function like for vivisect?

capa/tests/fixtures.py

Lines 119 to 128 in c85be8d

	def fixup_viv(path: Path, extractor):
	"""
	vivisect fixups to overcome differences between backends
	"""
	if "3b13b" in path.name:
	# vivisect only recognizes calling thunk function at 0x10001573
	extractor.vw.makeFunction(0x10006860)
	if "294b8d" in path.name:
	# see vivisect/#561
	extractor.vw.makeFunction(0x404970)

Otherwise, we can just skip/xfail the test with the missing function.

We definitely should! I was looking for a place to do it, but I cannot find an elegant place to plug it. But now I know how to do it