diff --git a/CHANGELOG.md b/CHANGELOG.md index 86c9cf5b..5709ef52 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,7 @@ ### New Features - verify rule metadata format on load #1160 @mr-tz - extract property features from .NET PE files #1168 @anushkavirgaonkar +- emit features for .NET newobj instruction #1186 @mike-hunhoff ### Breaking Changes diff --git a/capa/features/extractors/dnfile/helpers.py b/capa/features/extractors/dnfile/helpers.py index 98803873..3fef794d 100644 --- a/capa/features/extractors/dnfile/helpers.py +++ b/capa/features/extractors/dnfile/helpers.py @@ -50,6 +50,10 @@ class DnType(object): self.access = access self.namespace = namespace self.class_ = class_ + if member == ".ctor": + member = "ctor" + if member == ".cctor": + member = "cctor" self.member = member def __hash__(self): diff --git a/capa/features/extractors/dnfile/insn.py b/capa/features/extractors/dnfile/insn.py index d99dcd58..da88464f 100644 --- a/capa/features/extractors/dnfile/insn.py +++ b/capa/features/extractors/dnfile/insn.py @@ -94,7 +94,7 @@ def extract_insn_api_features(fh: FunctionHandle, bh, ih: InsnHandle) -> Iterato """parse instruction API features""" insn: Instruction = ih.inner - if insn.opcode not in (OpCodes.Call, OpCodes.Callvirt, OpCodes.Jmp, OpCodes.Calli): + if insn.opcode not in (OpCodes.Call, OpCodes.Callvirt, OpCodes.Jmp, OpCodes.Calli, OpCodes.Newobj): return callee: Union[DnType, DnUnmanagedMethod, None] = get_callee(fh.ctx, insn.operand.value) @@ -188,6 +188,7 @@ def extract_insn_class_features(fh: FunctionHandle, bh, ih: InsnHandle) -> Itera OpCodes.Ldsflda, OpCodes.Stfld, OpCodes.Stsfld, + OpCodes.Newobj, ): return @@ -220,6 +221,7 @@ def extract_insn_namespace_features(fh: FunctionHandle, bh, ih: InsnHandle) -> I OpCodes.Ldsflda, OpCodes.Stfld, OpCodes.Stsfld, + OpCodes.Newobj, ): return diff --git a/tests/fixtures.py b/tests/fixtures.py index b3045c93..8df1153f 100644 --- a/tests/fixtures.py +++ b/tests/fixtures.py @@ -725,8 +725,8 @@ FEATURE_PRESENCE_TESTS_DOTNET = sorted( ("b9f5b", "file", OS(OS_ANY), True), ("b9f5b", "file", Format(FORMAT_DOTNET), True), ("hello-world", "file", capa.features.file.FunctionName("HelloWorld::Main"), True), - ("hello-world", "file", capa.features.file.FunctionName("HelloWorld::.ctor"), True), - ("hello-world", "file", capa.features.file.FunctionName("HelloWorld::.cctor"), False), + ("hello-world", "file", capa.features.file.FunctionName("HelloWorld::ctor"), True), + ("hello-world", "file", capa.features.file.FunctionName("HelloWorld::cctor"), False), ("hello-world", "file", capa.features.common.String("Hello World!"), True), ("hello-world", "file", capa.features.common.Class("HelloWorld"), True), ("hello-world", "file", capa.features.common.Class("System.Console"), True),