From c80542ded3a6d53e348ab696c8f7e514f7c49f71 Mon Sep 17 00:00:00 2001 From: Willi Ballenthin Date: Wed, 16 Aug 2023 11:37:41 +0000 Subject: [PATCH] cape: call: fix argument type switch --- capa/features/extractors/cape/call.py | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/capa/features/extractors/cape/call.py b/capa/features/extractors/cape/call.py index 97e235a9..a9c4c7e6 100644 --- a/capa/features/extractors/cape/call.py +++ b/capa/features/extractors/cape/call.py @@ -36,18 +36,19 @@ def extract_call_features(ph: ProcessHandle, th: ThreadHandle, ch: CallHandle) - # list similar to disassembly: arguments right-to-left, call for arg in reversed(call.arguments): - if isinstance(arg, list) and len(arg) == 0: + value = arg.value + if isinstance(value, list) and len(arg) == 0: # unsure why CAPE captures arguments as empty lists? continue - elif isinstance(arg, str): - yield String(arg), ch.address + elif isinstance(value, str): + yield String(value), ch.address elif isinstance(arg, int): - yield Number(arg), ch.address + yield Number(value), ch.address else: - assert_never(arg) + assert_never(value) yield API(call.api), ch.address