From aa8e4603d1f330ce1983cc0bc83db69436a4cbe0 Mon Sep 17 00:00:00 2001 From: Willi Ballenthin Date: Mon, 9 Dec 2024 09:37:58 +0000 Subject: [PATCH] inspect-binexport2: render aarch64 vector element sizes closes #2528 --- scripts/inspect-binexport2.py | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/scripts/inspect-binexport2.py b/scripts/inspect-binexport2.py index 9e205b0d..11e1677e 100644 --- a/scripts/inspect-binexport2.py +++ b/scripts/inspect-binexport2.py @@ -81,8 +81,21 @@ def _render_expression_tree( if expression.type == BinExport2.Expression.REGISTER: o.write(expression.symbol) - assert len(children_tree_indexes) == 0 - return + assert len(children_tree_indexes) <= 1 + + if len(children_tree_indexes) == 0: + return + elif len(children_tree_indexes) == 1: + # like for aarch64 with vector instructions, indicating vector data size: + # + # FADD V0.4S, V1.4S, V2.4S + # + # see: https://github.com/mandiant/capa/issues/2528 + child_index = children_tree_indexes[0] + _render_expression_tree(be2, operand, expression_tree, child_index, o) + return + else: + raise NotImplementedError(len(children_tree_indexes)) elif expression.type == BinExport2.Expression.SYMBOL: o.write(expression.symbol)