From a273ad31d4e5fc6d556d99e10a1b9915a373e2a8 Mon Sep 17 00:00:00 2001 From: Moritz Date: Wed, 11 Jan 2023 17:17:04 +0100 Subject: [PATCH] make read consistent with file object behavior (#1281) --- CHANGELOG.md | 1 + capa/ida/helpers.py | 8 +++++--- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c98cdd44..86be5431 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -94,6 +94,7 @@ - generator: refactor caching and matching #1251 @mike-hunhoff - fix: improve exception handling to prevent IDA from locking up when errors occur #1262 @mike-hunhoff - verify rule metadata using Pydantic #1167 @mr-tz +- extractor: make read consistent with file object behavior #1254 @mr-tz ### Development diff --git a/capa/ida/helpers.py b/capa/ida/helpers.py index d1ef3093..2d12e931 100644 --- a/capa/ida/helpers.py +++ b/capa/ida/helpers.py @@ -181,11 +181,13 @@ class IDAIO: def read(self, size): ea = ida_loader.get_fileregion_ea(self.offset) if ea == idc.BADADDR: - # best guess, such as if file is mapped at address 0x0. - ea = self.offset + logger.debug("cannot read 0x%x bytes at 0x%x (ea: BADADDR)", size, self.offset) + return b"" logger.debug("reading 0x%x bytes at 0x%x (ea: 0x%x)", size, self.offset, ea) - return ida_bytes.get_bytes(ea, size) + + # get_bytes returns None on error, for consistency with read always return bytes + return ida_bytes.get_bytes(ea, size) or b"" def close(self): return