Very slow analysis for a small exe, how to debug?

[arian487]

I am decompiling a small exe (1.6mb) and I've written a little pyghidra script to do this, and the analysis takes ~1 hour, and ultimately returns a single non stub function (and about 6000 functions total). I'm not doing anything fancy as far as I can tell. Other larger binaries are much faster. Mostly I'd like to be able to have a way of identifying this and cancelling programmatically without just setting a generic timeout if I decompile more binaries that have this same issue and also make sure i'm not doing something especially dumb

I hooked up a TaskMonitor for logging and the culprit seems to be Decompile Parameter ID. I'm on a 16core machine, and it is definitely using the cores to do...something.

[arian487]

For reference this is basically how I am doing it:

with pyghidra.open_program(self.binary_path, project_location=tempdir, analyze=False) as flat_api:
         program = flat_api.getCurrentProgram()
         from ghidra.app.plugin.core.analysis import AutoAnalysisManager
         manager = AutoAnalysisManager.getAnalysisManager(program)
         manager.initializeOptions()
         monitor = self.CustomTaskMonitor()
         manager.reAnalyzeAll(None)
         manager.startAnalysis(monitor, True)
         manager.waitForAnalysis(None, monitor)

This block is taking ~1 hour. I believe I have also given ghidra adequate memory:

launcher = HeadlessPyGhidraLauncher()
launcher.add_vmargs("-Xms4g", "-Xmx40G")
launcher.start()

[ryanmkurtz]

It sounds like you have figured out how to implement a timeout solution. But, you are looking to examine the state of things while analysis is going, and then cancel based on some condition other than time?

[arian487]

Can I send it via email perhaps?

[ryanmkurtz]

Zipping it seems to work for most people

[arian487]

NuGet.exe.zip

Thanks i really appreciate the help

[ryanmkurtz]

It looks like a .NET binary, which we don't have great support for. Specifically, we don't support the processor.

[ryanmkurtz]

If you wanted to avoid these binaries, you could get the Options from the Program and lookup the value of the Compiler key, which will be set to cli.

[ryanmkurtz]

I think you can actually just do program.getCompiler() == "cli"

[arian487]

Wow this is exactly what I was looking for. Thank you so much! Are there other binary types I should be aware that will be very slow?

[ryanmkurtz]

None that I know of, but let us know if you run into any issues.