Skip to content

fix: mitmdump process leaked and respawned on every dynamic analysis run - #2658

Open
alanhasn wants to merge 1 commit into
MobSF:masterfrom
alanhasn:fix-mitmdump-process-leak
Open

fix: mitmdump process leaked and respawned on every dynamic analysis run#2658
alanhasn wants to merge 1 commit into
MobSF:masterfrom
alanhasn:fix-mitmdump-process-leak

Conversation

@alanhasn

Copy link
Copy Markdown

Closes #2543

Root cause

mobsf_agents_setup() in environment.py called create_ca() unconditionally on every dynamic analysis session. create_ca() spawns a detached mitmdump -n process to generate the CA cert, but:

  1. It was called even when the CA cert file already existed, spawning a redundant new mitmdump process on every single run.
  2. The spawned process was never stopped — it's fully detached (close_fds=True, no stdin/stdout/stderr), so it stayed running forever after the session ended.

This matches the reported behavior: a new mitmdump process appears every time Dynamic Analysis starts, and it never exits after stopping the analysis.

Fix

  • create_ca() now waits (polling, up to ~15s) for the CA cert file to actually appear, then calls proc.terminate() on the mitmdump process it started, since it's only needed transiently to generate the cert.
  • Removed the unconditional create_ca() call in mobsf_agents_setup(). install_mobsf_ca('install'), called right after, already goes through get_ca_file(), which only generates the CA if it doesn't already exist. The unconditional call was redundant and was the source of the "new process every run" behavior.

Testing

  • python -m py_compile on both changed files.
  • flake8 on both changed files — clean.
  • Manually traced all call sites of create_ca() / get_ca_file() to confirm no other code path relies on the old unconditional-spawn behavior.

mobsf_agents_setup() called create_ca() unconditionally on every
dynamic analysis session, spawning a new detached mitmdump process
even when the CA cert already existed. The spawned process was also
never stopped, so it stayed running indefinitely after the session
ended.

create_ca() now waits for the CA cert file to appear and terminates
mitmdump once it's done, and the redundant unconditional call in
mobsf_agents_setup() is removed in favor of the existing
get_ca_file() check (already used by install_mobsf_ca()).

Co-authored-by: alanhasn
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

mitmdump process not exit properly after stop dynamic analysis

1 participant