From 469e2ff870d765db92b3dd1359c130e3a40bc575 Mon Sep 17 00:00:00 2001 From: William Ballenthin Date: Wed, 9 Jun 2021 23:12:07 -0600 Subject: [PATCH] type: capa.features.extractors.viv.basicblock --- capa/features/extractors/viv/basicblock.py | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/capa/features/extractors/viv/basicblock.py b/capa/features/extractors/viv/basicblock.py index 510513f8..ba8cf09c 100644 --- a/capa/features/extractors/viv/basicblock.py +++ b/capa/features/extractors/viv/basicblock.py @@ -73,7 +73,7 @@ def extract_stackstring(f, bb): yield Characteristic("stack string"), bb.va -def is_mov_imm_to_stack(instr): +def is_mov_imm_to_stack(instr: envi.archs.i386.disasm.i386Opcode) -> bool: """ Return if instruction moves immediate onto stack """ @@ -105,7 +105,7 @@ def is_mov_imm_to_stack(instr): return True -def get_printable_len(oper): +def get_printable_len(oper: envi.archs.i386.disasm.i386ImmOper) -> int: """ Return string length if all operand bytes are ascii or utf16-le printable """ @@ -128,7 +128,7 @@ def get_printable_len(oper): return 0 -def is_printable_ascii(chars): +def is_printable_ascii(chars: bytes) -> bool: try: chars_str = chars.decode("ascii") except UnicodeDecodeError: @@ -137,9 +137,10 @@ def is_printable_ascii(chars): return all(c in string.printable for c in chars_str) -def is_printable_utf16le(chars): +def is_printable_utf16le(chars: bytes) -> bool: if all(c == b"\x00" for c in chars[1::2]): return is_printable_ascii(chars[::2]) + return False def extract_features(f, bb):