gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2026-02-04 11:07:53 -08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #346 from fireeye/extract/api-jmps

Browse Source 
Extract/api jmps
This commit is contained in:
Moritz
2020-10-23 13:15:10 +02:00
committed by GitHub
parent 8bb305038b 69a4b99d70
commit 425613ee42
4 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
capa/features/extractors/ida/insn.py
View File

@@ -54,7 +54,7 @@ def get_imports(ctx):
def check_for_api_call(ctx, insn):
""" check instruction for API call """
if not idaapi.is_call_insn(insn):
if not insn.get_canon_mnem() in ("call", "jmp"):
return
info = ()

2
capa/features/extractors/viv/indirect_calls.py
View File

@@ -132,7 +132,7 @@ def is_indirect_call(vw, va, insn=None):
if insn is None:
insn = vw.parseOpcode(va)
return insn.mnem == "call" and isinstance(insn.opers[0], envi.archs.i386.disasm.i386RegOper)
return insn.mnem in ("call", "jmp") and isinstance(insn.opers[0], envi.archs.i386.disasm.i386RegOper)
def resolve_indirect_call(vw, va, insn=None):

6
capa/features/extractors/viv/insn.py
View File

@@ -75,9 +75,13 @@ def extract_insn_api_features(f, bb, insn):
#
# call dword [0x00473038]
if insn.mnem != "call":
if insn.mnem not in ("call", "jmp"):
return
if insn.mnem == "jmp":
if f.vw.getFunctionMeta(f.va, "Thunk"):
return
# traditional call via IAT
if isinstance(insn.opers[0], envi.archs.i386.disasm.i386ImmMemOper):
oper = insn.opers[0]

4
tests/fixtures.py
View File

@@ -375,6 +375,10 @@ FEATURE_PRESENCE_TESTS = [
("kernel32-64", "function=0x1800202B0", capa.features.insn.API("RtlCaptureContext"), True),
# insn/api: x64 nested thunk
("82bf6", "function=0x140059342", capa.features.insn.API("ElfClearEventLogFile"), True),
# insn/api: call via jmp
("mimikatz", "function=0x40B3C6", capa.features.insn.API("LocalFree"), True),
("c91887...", "function=0x40156F", capa.features.insn.API("CloseClipboard"), True),
# TODO ignore thunk functions that call via jmp?
# insn/api: resolve indirect calls
("c91887...", "function=0x401A77", capa.features.insn.API("kernel32.CreatePipe"), True),
("c91887...", "function=0x401A77", capa.features.insn.API("kernel32.SetHandleInformation"), True),