gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2025-12-12 15:49:46 -08:00
Code Issues Packages Projects Releases Wiki Activity

vmray: clean up VMRayAnalysis

Browse Source
This commit is contained in:
Mike Hunhoff
2024-06-13 16:48:12 -06:00
parent 8d3f032434
commit 346a0693ad
2 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
capa/features/extractors/vmray/__init__.py
View File

@@ -21,7 +21,7 @@ class VMRayAnalysis:
self.sample_file_name: str
self.sample_file_analysis: File
self.sample_file_static_data: Optional[StaticData]
self.sample_file_static_data: StaticData
self._find_sample_file()
self._compute_base_address()
@@ -36,16 +36,16 @@ class VMRayAnalysis:
self.sample_file_analysis = file_analysis
if file_analysis.ref_static_data:
self.sample_file_static_data = self.sv2.static_data.get(file_analysis.ref_static_data.path[1])
self.sample_file_static_data = self.sv2.static_data[file_analysis.ref_static_data.path[1]]
break
def _compute_base_address(self):
if self.sample_file_static_data and self.sample_file_static_data.pe:
if self.sample_file_static_data.pe:
self.base_address = self.sample_file_static_data.pe.basic_info.image_base
def _compute_exports(self):
if self.sample_file_static_data and self.sample_file_static_data.pe:
if self.sample_file_static_data.pe:
for export in self.sample_file_static_data.pe.exports:
self.exports[export.address] = export.api.name
@@ -54,6 +54,6 @@ class VMRayAnalysis:
...
def _compute_sections(self):
if self.sample_file_static_data and self.sample_file_static_data.pe:
if self.sample_file_static_data.pe:
for section in self.sample_file_static_data.pe.sections:
self.sections[section.virtual_address] = section.name

2
capa/features/extractors/vmray/extractor.py
View File

@@ -55,4 +55,4 @@ if __name__ == "__main__":
for feat, addr in extractor.extract_file_features():
print(f"{feat} -> {addr}")
print(f"base address: {hex(extractor.get_base_address())}")
print(f"base address: {hex(extractor.get_base_address())}")