gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2025-12-12 15:49:46 -08:00
Code Issues Packages Projects Releases Wiki Activity

formatting

Browse Source
This commit is contained in:
mr-tz
2024-06-19 14:55:43 +00:00
parent d10b396300
commit 453a640de9
1 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
capa/features/extractors/vmray/call.py
View File

@@ -5,7 +5,7 @@ from capa.helpers import assert_never
from capa.features.insn import API, Number
from capa.features.common import String, Feature
from capa.features.address import Address
from capa.features.extractors.vmray.models import FunctionCall, Analysis
from capa.features.extractors.vmray.models import Analysis, FunctionCall
from capa.features.extractors.base_extractor import CallHandle, ThreadHandle, ProcessHandle
logger = logging.getLogger(__name__)
@@ -18,12 +18,12 @@ def extract_function_calls(ph: ProcessHandle, th: ThreadHandle, ch: CallHandle)
args:
call: FunctionCall object representing the XML fncall element
yields: Feature, address; where Feature is either: API, Number, or String.
"""
# Extract API name
yield API(ch.inner.name), ch.inner.address
yield API(ch.inner.name), ch.inner.address
# Extract arguments from <in>
for param in ch.inner.in_:
@@ -49,9 +49,10 @@ def extract_function_calls(ph: ProcessHandle, th: ThreadHandle, ch: CallHandle)
else:
assert_never(value)
def extract_features(analysis: Analysis) -> Iterator[Tuple[Feature, Address]]:
'''
"""
Extract features from the Analysis object in models.py
'''
"""
for fncall in analysis.fncalls:
yield from extract_function_calls(fncall)
yield from extract_function_calls(fncall)