gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2025-12-12 23:59:48 -08:00
Code Issues Packages Projects Releases Wiki Activity

adding code to emit number feature for unmapped immediate data reference

Browse Source
This commit is contained in:
Michael Hunhoff
2020-08-11 10:34:44 -06:00
parent db85fbab4f
commit 791afd7ac8
3 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
capa/features/extractors/ida/insn.py
View File

@@ -98,8 +98,11 @@ def extract_insn_number_features(f, bb, insn):
# .text:00401145 add esp, 0Ch # .text:00401145 add esp, 0Ch
return return
for op in capa.features.extractors.ida.helpers.get_insn_ops(insn, target_ops=(idaapi.o_imm,)): for op in capa.features.extractors.ida.helpers.get_insn_ops(insn, target_ops=(idaapi.o_imm, idaapi.o_mem)):
const = capa.features.extractors.ida.helpers.mask_op_val(op) if op.type == idaapi.o_imm:
const = capa.features.extractors.ida.helpers.mask_op_val(op)
else:
const = op.addr
if not idaapi.is_mapped(const): if not idaapi.is_mapped(const):
yield Number(const), insn.ea yield Number(const), insn.ea
yield Number(const, arch=get_arch(f.ctx)), insn.ea yield Number(const, arch=get_arch(f.ctx)), insn.ea

7
capa/features/extractors/viv/insn.py
View File

@@ -128,10 +128,13 @@ def extract_insn_number_features(f, bb, insn):
# push 3136B0h ; dwControlCode # push 3136B0h ; dwControlCode
for oper in insn.opers: for oper in insn.opers:
# this is for both x32 and x64 # this is for both x32 and x64
if not isinstance(oper, envi.archs.i386.disasm.i386ImmOper): if not isinstance(oper, (envi.archs.i386.disasm.i386ImmOper, envi.archs.i386.disasm.i386ImmMemOper)):
continue continue
v = oper.getOperValue(oper) if isinstance(oper, envi.archs.i386.disasm.i386ImmOper):
v = oper.getOperValue(oper)
else:
v = oper.getOperAddr(oper)
if f.vw.probeMemory(v, 1, envi.memory.MM_READ): if f.vw.probeMemory(v, 1, envi.memory.MM_READ):
# this is a valid address # this is a valid address

2
tests/data

Submodule tests/data updated: 39ee1f0c5c...60db141dce