diff --git a/capa/features/extractors/ida/insn.py b/capa/features/extractors/ida/insn.py index 8e5c11d5..31870ddf 100644 --- a/capa/features/extractors/ida/insn.py +++ b/capa/features/extractors/ida/insn.py @@ -218,7 +218,7 @@ def extract_insn_offset_features(f, bb, insn): yield Offset(op_off), insn.ea yield OperandOffset(i, op_off), insn.ea - if i == 1 and op.type == idaapi.o_phrase: + if insn.itype == idaapi.NN_lea and i == 1 and op.type == idaapi.o_displ: # for pattern like: # # lea eax, [ebx + 1] diff --git a/capa/features/extractors/viv/insn.py b/capa/features/extractors/viv/insn.py index 17609639..b22a71f9 100644 --- a/capa/features/extractors/viv/insn.py +++ b/capa/features/extractors/viv/insn.py @@ -576,7 +576,7 @@ def extract_op_offset_features(f, bb, insn, i, oper): yield Offset(v), insn.va yield OperandOffset(i, v), insn.va - if i == 1 and not f.vw.probeMemory(v, 1, envi.memory.MM_READ): + if insn.mnem == "lea" and i == 1 and not f.vw.probeMemory(v, 1, envi.memory.MM_READ): # for pattern like: # # lea eax, [ebx + 1]