From 70d36ab6406a46b5bc9c2cac3866a80a8c8ea38d Mon Sep 17 00:00:00 2001 From: Colton Gabertan <66766340+colton-gabertan@users.noreply.github.com> Date: Wed, 23 Aug 2023 14:40:15 -0700 Subject: [PATCH] properly set bounds for find_byte_sequence (#1757) --- capa/features/extractors/ghidra/helpers.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/capa/features/extractors/ghidra/helpers.py b/capa/features/extractors/ghidra/helpers.py index b2f1238e..3acae264 100644 --- a/capa/features/extractors/ghidra/helpers.py +++ b/capa/features/extractors/ghidra/helpers.py @@ -8,6 +8,7 @@ from typing import Dict, List, Iterator import ghidra +import java.lang from ghidra.program.model.lang import OperandType from ghidra.program.model.block import BasicBlockModel, SimpleBlockIterator from ghidra.program.model.symbol import SourceType, SymbolType @@ -36,7 +37,7 @@ def find_byte_sequence(seq: bytes) -> Iterator[int]: """ seqstr = "".join([f"\\x{b:02x}" for b in seq]) # .add(1) to avoid false positives on regular PE files - eas = findBytes(currentProgram().getMinAddress().add(1), seqstr, 1, 1) # type: ignore [name-defined] # noqa: F821 + eas = findBytes(currentProgram().getMinAddress().add(1), seqstr, java.lang.Integer.MAX_VALUE, 1) # type: ignore [name-defined] # noqa: F821 yield from eas