From a75d7576f8a265fd0485fbcc89f147bfc8ff6476 Mon Sep 17 00:00:00 2001 From: William Ballenthin Date: Wed, 9 Jun 2021 23:08:29 -0600 Subject: [PATCH] type: capa.features.extractors.viv.indirect_calls --- capa/features/extractors/viv/indirect_calls.py | 12 ++++++++---- capa/render/default.py | 12 ++++-------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/capa/features/extractors/viv/indirect_calls.py b/capa/features/extractors/viv/indirect_calls.py index 1d160cbb..767b2556 100644 --- a/capa/features/extractors/viv/indirect_calls.py +++ b/capa/features/extractors/viv/indirect_calls.py @@ -7,11 +7,15 @@ # See the License for the specific language governing permissions and limitations under the License. import collections +from typing import List, Tuple, Optional import envi import vivisect.const import envi.archs.i386.disasm import envi.archs.amd64.disasm +from vivisect import VivWorkspace + +from capa.features.extractors.viv.extractor import InstructionHandle # pull out consts for lookup performance i386RegOper = envi.archs.i386.disasm.i386RegOper @@ -26,7 +30,7 @@ FAR_BRANCH_MASK = envi.BR_PROC | envi.BR_DEREF | envi.BR_ARCH DESTRUCTIVE_MNEMONICS = ("mov", "lea", "pop", "xor") -def get_previous_instructions(vw, va): +def get_previous_instructions(vw: VivWorkspace, va: int) -> List[int]: """ collect the instructions that flow to the given address, local to the current function. @@ -67,7 +71,7 @@ class NotFoundError(Exception): pass -def find_definition(vw, va, reg): +def find_definition(vw: VivWorkspace, va: int, reg: int) -> Tuple[int, int]: """ scan backwards from the given address looking for assignments to the given register. if a constant, return that value. @@ -128,14 +132,14 @@ def find_definition(vw, va, reg): raise NotFoundError() -def is_indirect_call(vw, va, insn=None): +def is_indirect_call(vw: VivWorkspace, va: int, insn: Optional[InstructionHandle] = None) -> bool: if insn is None: insn = vw.parseOpcode(va) return insn.mnem in ("call", "jmp") and isinstance(insn.opers[0], envi.archs.i386.disasm.i386RegOper) -def resolve_indirect_call(vw, va, insn=None): +def resolve_indirect_call(vw: VivWorkspace, va: int, insn: Optional[InstructionHandle] = None) -> Tuple[int, int]: """ inspect the given indirect call instruction and attempt to resolve the target address. diff --git a/capa/render/default.py b/capa/render/default.py index e0501da3..3462e23a 100644 --- a/capa/render/default.py +++ b/capa/render/default.py @@ -7,19 +7,15 @@ # See the License for the specific language governing permissions and limitations under the License. import collections +from typing import Dict, List, Tuple import tabulate -from typing import ( - Dict, - List, - Tuple, -) -from capa.engine import Result -from capa.render.utils import StringIO -from capa.rules import RuleSet import capa.render.utils as rutils import capa.render.result_document +from capa.rules import RuleSet +from capa.engine import Result +from capa.render.utils import StringIO tabulate.PRESERVE_WHITESPACE = True