This commit is contained in:
Willi Ballenthin
2022-04-08 12:46:43 -06:00
parent 43b8ad80c7
commit 2b00bc0fdb
4 changed files with 14 additions and 4 deletions

View File

@@ -54,7 +54,7 @@ class DNTokenOffsetAddress(Address):
def __init__(self, token: Token, offset: int):
assert offset >= 0
self.token = token
self.rva = offset
self.offset = offset
class _NoAddress(Address):

View File

@@ -17,8 +17,8 @@ import capa.features.extractors.helpers
import capa.features.extractors.strings
from capa.features.file import Export, Import, Section
from capa.features.common import OS, ARCH_I386, FORMAT_PE, ARCH_AMD64, OS_WINDOWS, Arch, Format, Characteristic
from capa.features.address import NO_ADDRESS, FileOffsetAddress, AbsoluteVirtualAddress
from capa.features.extractors.base_extractor import FeatureExtractor
from capa.features.address import NO_ADDRESS, AbsoluteVirtualAddress, FileOffsetAddress
logger = logging.getLogger(__name__)

View File

@@ -589,7 +589,9 @@ def extract_op_number_features(
yield OperandOffset(i, v), ihandle.address
def extract_op_offset_features(fhandle: FunctionHandle, bb, ihandle: InsnHandle, i, oper: envi.Operand) -> Iterator[Tuple[Feature, Address]]:
def extract_op_offset_features(
fhandle: FunctionHandle, bb, ihandle: InsnHandle, i, oper: envi.Operand
) -> Iterator[Tuple[Feature, Address]]:
"""parse structure offset features from the given operand."""
# example:
#

View File

@@ -29,7 +29,15 @@ import capa.render.utils as rutils
import capa.render.result_document
from capa.rules import RuleSet
from capa.engine import MatchResults
from capa.features.address import Address, AbsoluteVirtualAddress, DNTokenAddress, FileOffsetAddress, NO_ADDRESS, RelativeVirtualAddress, DNTokenOffsetAddress
from capa.features.address import (
NO_ADDRESS,
Address,
DNTokenAddress,
FileOffsetAddress,
DNTokenOffsetAddress,
AbsoluteVirtualAddress,
RelativeVirtualAddress,
)
def format_address(address: Address) -> str: