diff --git a/capa/features/extractors/ida/insn.py b/capa/features/extractors/ida/insn.py index 225f2613..d06d01e9 100644 --- a/capa/features/extractors/ida/insn.py +++ b/capa/features/extractors/ida/insn.py @@ -98,8 +98,11 @@ def extract_insn_number_features(f, bb, insn): # .text:00401145 add esp, 0Ch return - for op in capa.features.extractors.ida.helpers.get_insn_ops(insn, target_ops=(idaapi.o_imm,)): - const = capa.features.extractors.ida.helpers.mask_op_val(op) + for op in capa.features.extractors.ida.helpers.get_insn_ops(insn, target_ops=(idaapi.o_imm, idaapi.o_mem)): + if op.type == idaapi.o_imm: + const = capa.features.extractors.ida.helpers.mask_op_val(op) + else: + const = op.addr if not idaapi.is_mapped(const): yield Number(const), insn.ea yield Number(const, arch=get_arch(f.ctx)), insn.ea diff --git a/capa/features/extractors/viv/insn.py b/capa/features/extractors/viv/insn.py index a00cfeb7..5aa8e3e1 100644 --- a/capa/features/extractors/viv/insn.py +++ b/capa/features/extractors/viv/insn.py @@ -128,10 +128,13 @@ def extract_insn_number_features(f, bb, insn): # push 3136B0h ; dwControlCode for oper in insn.opers: # this is for both x32 and x64 - if not isinstance(oper, envi.archs.i386.disasm.i386ImmOper): + if not isinstance(oper, (envi.archs.i386.disasm.i386ImmOper, envi.archs.i386.disasm.i386ImmMemOper)): continue - v = oper.getOperValue(oper) + if isinstance(oper, envi.archs.i386.disasm.i386ImmOper): + v = oper.getOperValue(oper) + else: + v = oper.getOperAddr(oper) if f.vw.probeMemory(v, 1, envi.memory.MM_READ): # this is a valid address diff --git a/tests/data b/tests/data index 39ee1f0c..60db141d 160000 --- a/tests/data +++ b/tests/data @@ -1 +1 @@ -Subproject commit 39ee1f0c5c7370d654cfee6b40c591addf1739e1 +Subproject commit 60db141dce792b1385eb1f7ce34893b53406d455