gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2025-12-24 03:57:34 -08:00
Code Issues Packages Projects Releases Wiki Activity

extract apis called via jmp

Browse Source 
closes #337
This commit is contained in:
Moritz Raabe
2020-10-20 18:05:31 +02:00
parent 39d95b2fd2
commit 69a4b99d70
4 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
tests/fixtures.py
View File

@@ -375,6 +375,10 @@ FEATURE_PRESENCE_TESTS = [
("kernel32-64", "function=0x1800202B0", capa.features.insn.API("RtlCaptureContext"), True),
# insn/api: x64 nested thunk
("82bf6", "function=0x140059342", capa.features.insn.API("ElfClearEventLogFile"), True),
# insn/api: call via jmp
("mimikatz", "function=0x40B3C6", capa.features.insn.API("LocalFree"), True),
("c91887...", "function=0x40156F", capa.features.insn.API("CloseClipboard"), True),
# TODO ignore thunk functions that call via jmp?
# insn/api: resolve indirect calls
("c91887...", "function=0x401A77", capa.features.insn.API("kernel32.CreatePipe"), True),
("c91887...", "function=0x401A77", capa.features.insn.API("kernel32.SetHandleInformation"), True),