gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2026-02-04 11:07:53 -08:00
Code Issues Packages Projects Releases Wiki Activity

ida: use FileOffsetAddress for embedded PE

Browse Source 
closes ida: embedded pe: offsets are virtual addresses rather than file offsets
Fixes #2746
This commit is contained in:
Willi Ballenthin
2025-11-03 12:07:32 +00:00
parent 5ea63770ba
commit 6a727fa8c0
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
capa/features/extractors/ida/file.py
View File

@@ -20,6 +20,7 @@ import idc
import idaapi
import idautils
import ida_entry
import ida_loader
import capa.ida.helpers
import capa.features.extractors.common
@@ -87,7 +88,8 @@ def extract_file_embedded_pe() -> Iterator[tuple[Feature, Address]]:
"""
for seg in capa.features.extractors.ida.helpers.get_segments(skip_header_segments=True):
for ea, _ in check_segment_for_pe(seg):
yield Characteristic("embedded pe"), FileOffsetAddress(ea)
off = ida_loader.get_fileregion_offset(ea)
yield Characteristic("embedded pe"), FileOffsetAddress(off)
def extract_file_export_names() -> Iterator[tuple[Feature, Address]]:
@@ -161,10 +163,12 @@ def extract_file_strings() -> Iterator[tuple[Feature, Address]]:
# differing to common string extractor factor in segment offset here
for s in capa.features.extractors.strings.extract_ascii_strings(seg_buff):
yield String(s.s), FileOffsetAddress(seg.start_ea + s.offset)
off = ida_loader.get_fileregion_offset(seg.start_ea + s.offset)
yield String(s.s), FileOffsetAddress(off)
for s in capa.features.extractors.strings.extract_unicode_strings(seg_buff):
yield String(s.s), FileOffsetAddress(seg.start_ea + s.offset)
off = ida_loader.get_fileregion_offset(seg.start_ea + s.offset)
yield String(s.s), FileOffsetAddress(off)
def extract_file_function_names() -> Iterator[tuple[Feature, Address]]: