From 9f4479582a1b416f561a00aab646a931b624436c Mon Sep 17 00:00:00 2001 From: Moritz Raabe Date: Fri, 1 Jul 2022 15:40:23 +0200 Subject: [PATCH] check address value closes #1081 --- capa/features/extractors/viv/insn.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/capa/features/extractors/viv/insn.py b/capa/features/extractors/viv/insn.py index 998a9cf3..ae106c31 100644 --- a/capa/features/extractors/viv/insn.py +++ b/capa/features/extractors/viv/insn.py @@ -502,7 +502,8 @@ def extract_function_calls_from(fh: FunctionHandle, bb, ih: InsnHandle) -> Itera # see Lab21-01.exe_:0x140001178 elif isinstance(insn.opers[0], envi.archs.i386.disasm.i386PcRelOper): target = insn.opers[0].getOperValue(insn) - yield Characteristic("calls from"), AbsoluteVirtualAddress(target) + if target >= 0: + yield Characteristic("calls from"), AbsoluteVirtualAddress(target) # call via IAT, x64 elif isinstance(insn.opers[0], envi.archs.amd64.disasm.Amd64RipRelOper):