gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2025-12-12 15:49:46 -08:00
Code Issues Packages Projects Releases Wiki Activity

elf: os: bug fixes

Browse Source
This commit is contained in:
Willi Ballenthin
2022-12-12 11:41:01 +01:00
parent 22bef146f8
commit d4a218e268
1 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
capa/features/extractors/elf.py
View File

@@ -410,7 +410,9 @@ class ELF:
if vn_next == 0:
break
return dict(versions_needed)
return dict(versions_needed)
return {}
@property
def dynamic_entries(self) -> Iterator[Tuple[int, int]]:
@@ -533,7 +535,9 @@ class PHNote:
@property
def abi_tag(self) -> Optional[ABITag]:
if self.type_ != 1:
# TODO: what is this constant name?
# > The type field shall be 1.
# Linux Standard Base Specification 1.2
# ref: https://refspecs.linuxfoundation.org/LSB_1.2.0/gLSB/noteabitag.html
return None
if self.name != "GNU":
@@ -612,7 +616,9 @@ def guess_os_from_ph_notes(elf) -> Optional[OS]:
note = PHNote(elf.endian, phdr.buf)
if note.type_ != 1:
# TODO: what is this constant name?
# > The type field shall be 1.
# Linux Standard Base Specification 1.2
# ref: https://refspecs.linuxfoundation.org/LSB_1.2.0/gLSB/noteabitag.html
continue
if note.name == "Linux":
@@ -689,7 +695,7 @@ def guess_os_from_abi_versions_needed(elf) -> Optional[OS]:
if any(map(lambda abi: abi.startswith("GLIBC"), itertools.chain(*versions_needed.values()))):
# there are any GLIBC versions needed
if elf.e_machine != "386":
if elf.e_machine != "i386":
# GLIBC runs on Linux and Hurd.
# for Hurd, its *only* on i386.
# so if we're not on i386, then we're on Linux.