diff --git a/capa/features/extractors/vmray/call.py b/capa/features/extractors/vmray/call.py index f6a3167a..8a247564 100644 --- a/capa/features/extractors/vmray/call.py +++ b/capa/features/extractors/vmray/call.py @@ -5,7 +5,7 @@ from capa.helpers import assert_never from capa.features.insn import API, Number from capa.features.common import String, Feature from capa.features.address import Address -from capa.features.extractors.vmray.models import FunctionCall, Analysis +from capa.features.extractors.vmray.models import Analysis, FunctionCall from capa.features.extractors.base_extractor import CallHandle, ThreadHandle, ProcessHandle logger = logging.getLogger(__name__) @@ -18,12 +18,12 @@ def extract_function_calls(ph: ProcessHandle, th: ThreadHandle, ch: CallHandle) args: call: FunctionCall object representing the XML fncall element - + yields: Feature, address; where Feature is either: API, Number, or String. """ # Extract API name - yield API(ch.inner.name), ch.inner.address + yield API(ch.inner.name), ch.inner.address # Extract arguments from for param in ch.inner.in_: @@ -49,9 +49,10 @@ def extract_function_calls(ph: ProcessHandle, th: ThreadHandle, ch: CallHandle) else: assert_never(value) + def extract_features(analysis: Analysis) -> Iterator[Tuple[Feature, Address]]: - ''' + """ Extract features from the Analysis object in models.py - ''' + """ for fncall in analysis.fncalls: - yield from extract_function_calls(fncall) \ No newline at end of file + yield from extract_function_calls(fncall)