diff --git a/capa/features/extractors/ida/insn.py b/capa/features/extractors/ida/insn.py index c180c2fa..6440164b 100644 --- a/capa/features/extractors/ida/insn.py +++ b/capa/features/extractors/ida/insn.py @@ -149,6 +149,9 @@ def extract_insn_offset_features(f, bb, insn): # mov esi, dword_1005B148[esi] continue + # I believe that IDA encodes all offsets as two's complement in a u32. + # a 64-bit displacement isn't a thing, see: + # https://stackoverflow.com/questions/31853189/x86-64-assembly-why-displacement-not-64-bits op_off = capa.features.extractors.helpers.twos_complement(op_off, 32) yield Offset(op_off), insn.ea diff --git a/tests/test_ida_features.py b/tests/test_ida_features.py index 6c967937..562158f1 100644 --- a/tests/test_ida_features.py +++ b/tests/test_ida_features.py @@ -273,7 +273,7 @@ def test_basic_block_count(): if __name__ == "__main__": print("-" * 80) - # invoke all functions in this module that start with `parse_` + # invoke all functions in this module that start with `test_` for name in dir(sys.modules[__name__]): if not name.startswith("test_"): continue