fix(idalib): only pass -R when creating new database

[Young-Lord]

closes #2950

Checklist

• No CHANGELOG update needed -- Bug not present in previous versions

• No new tests needed

• No documentation update needed

• This submission includes AI-generated code and I have provided details in the description.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request resolves an issue where the IDA Pro -R flag, intended for loading resources during new database creation, was being erroneously applied when opening pre-existing IDA databases. The fix ensures that this flag is only used in the appropriate context, enhancing the stability and correctness of IDA database operations within the capa framework.

Highlights

• IDA Database Loading: The -R flag, which loads resources, is now conditionally applied only when creating a new IDA database. Previously, it was always passed, causing issues when opening existing databases. This change prevents errors and improves the reliability of IDA database interactions.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request fixes an issue where the -R flag was passed to IDA even when opening an existing database, which is not a valid use of the flag. The change correctly detects if an IDA database already exists and only adds the -R flag when creating a new one. My main feedback is regarding code duplication. The logic for determining the IDA arguments has been added to both capa/loader.py and tests/fixtures.py. I've left comments suggesting to extract this logic into a shared helper function to improve maintainability.

[gemini-code-assist]

This logic for determining the IDA database arguments is duplicated in tests/fixtures.py. To improve maintainability and avoid future inconsistencies, consider extracting this logic into a shared helper function.

For example, you could create a function in this module or a more specific IDA helper module:

IDA_DB_EXTENSIONS = (".ida", ".i64", ".id0")
IDA_LUMINA_ARGS = "-Olumina:host=0.0.0.0 -Osecondary_lumina:host=0.0.0.0"

def get_ida_open_database_args(input_path: Path) -> str:
    """
    Get the arguments for opening an IDA database, conditionally adding the `-R` flag.
    `-R` (load resources) is only valid when loading a new input file.
    If an IDA database already exists, we open it without `-R`.
    """
    # ref: https://github.com/mandiant/capa/issues/2950
    has_existing_database = any(
        input_path.with_name(input_path.name + ext).exists()
        for ext in IDA_DB_EXTENSIONS
    )
    open_database_args = IDA_LUMINA_ARGS
    if not has_existing_database:
        open_database_args += " -R"
    return open_database_args

You could then call this function here and in tests/fixtures.py to avoid the code duplication. Using constants for the extensions and arguments would also improve readability.

[gemini-code-assist]

This logic is a duplicate of the code in capa/loader.py. As mentioned in my other comment, this should be extracted into a shared helper function to improve maintainability.

[Young-Lord]

The test code seems to be duplicated from the source, so I followed the same approach.