gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2026-06-12 19:11:32 -07:00
Code Issues Packages Projects Releases Wiki Activity

fix: binja embedded PE yields FileOffsetAddress via segment data_offset

Browse Source 
carve_pe returns offsets into a raw byte buffer read from the segment.
Convert to file offset using the segment's data_offset rather than
emitting a virtual address.
This commit is contained in:
Willi Ballenthin
2026-05-07 12:33:52 +02:00
committed by Willi Ballenthin
parent c9cb43a839
commit 57e730fad2
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
capa/features/extractors/binja/file.py
+2 -1
View File
@@ -46,7 +46,8 @@ def check_segment_for_pe(bv: BinaryView, seg: Segment) -> Iterator[tuple[Feature
buf = bv.read(seg.start, seg.length)
for offset, _ in capa.features.extractors.helpers.carve_pe(buf, start):
yield Characteristic("embedded pe"), AbsoluteVirtualAddress(seg.start + offset)
if offset < seg.data_length:
yield Characteristic("embedded pe"), FileOffsetAddress(seg.data_offset + offset)
def extract_file_embedded_pe(bv: BinaryView) -> Iterator[tuple[Feature, Address]]: