gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2025-12-12 15:49:46 -08:00
Code Issues Packages Projects Releases Wiki Activity

switching to iterative solution for data reference search

Browse Source
This commit is contained in:
Michael Hunhoff
2020-08-11 08:43:38 -06:00
parent 79d94144c6
commit 828819e13f
1 changed files with 18 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
capa/features/extractors/ida/helpers.py
View File

@@ -333,26 +333,27 @@ def is_basic_block_tight_loop(bb):
return False
def find_data_reference_from_insn_helper(ea, max_depth=10):
""" recursive search for data reference, if exists, from instruction by resolving nested pointers, if exist """
if 0 == max_depth:
# return when max depth reached
return ea
def find_data_reference_from_insn(insn, max_depth=10):
""" search for data reference from instruction, return address of instruction if no reference exists """
depth = 0
ea = insn.ea
data_refs = list(idautils.DataRefsFrom(ea))
while True:
data_refs = list(idautils.DataRefsFrom(ea))
if len(data_refs) != 1:
# return if no refs or more than one ref (assume nested pointers only have one data reference)
return ea
if len(data_refs) != 1:
# break if no refs or more than one ref (assume nested pointers only have one data reference)
break
if ea == data_refs[0]:
# return if circular reference
return ea
if ea == data_refs[0]:
# break if circular reference
break
# continue searching
return find_data_reference_from_insn_helper(data_refs[0], max_depth - 1)
depth += 1
if depth > max_depth:
# break if max depth
break
ea = data_refs[0]
def find_data_reference_from_insn(insn):
""" return address of data reference, if exists, otherwise address of instruction """
return find_data_reference_from_insn_helper(insn.ea)
return ea