diff --git a/CHANGELOG.md b/CHANGELOG.md index 778d9042..f7d6ff5e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -41,6 +41,7 @@ - ### Bug Fixes +- extractor: removed '.dynsym' as the library name for ELF imports #1318 @stevemk14ebr - extractor: fix vivisect loop detection corner case #1310 @mr-tz - match: extend OS characteristic to match OS_ANY to all supported OSes #1324 @mike-hunhoff - extractor: fix IDA and vivisect string and bytes features overlap and tests #1327 #1336 @xusheng6 diff --git a/capa/features/extractors/ida/helpers.py b/capa/features/extractors/ida/helpers.py index dbb9bd1d..daec2152 100644 --- a/capa/features/extractors/ida/helpers.py +++ b/capa/features/extractors/ida/helpers.py @@ -90,8 +90,11 @@ def get_file_imports() -> Dict[int, Tuple[str, str, int]]: if not library: continue - # IDA uses section names for the library of ELF imports, like ".dynsym" - library = library.lstrip(".") + # IDA uses section names for the library of ELF imports, like ".dynsym". + # These are not useful to us, we may need to expand this list over time + # TODO: exhaust this list, see #1419 + if library == ".dynsym": + library = "" def inspect_import(ea, function, ordinal): if function and function.startswith("__imp_"):