mirror of
https://github.com/mandiant/capa.git
synced 2026-02-04 19:12:01 -08:00
pep8
This commit is contained in:
@@ -605,11 +605,20 @@ class SHNote:
|
||||
|
||||
|
||||
class SymTab:
|
||||
def __init__(self, endian: str, bitness: int, symtab_buf: bytes, symtab_entsize: int, symtab_sz: int, strtab_buf: bytes, strtab_sz: int) -> None:
|
||||
def __init__(
|
||||
self,
|
||||
endian: str,
|
||||
bitness: int,
|
||||
symtab_buf: bytes,
|
||||
symtab_entsize: int,
|
||||
symtab_sz: int,
|
||||
strtab_buf: bytes,
|
||||
strtab_sz: int,
|
||||
) -> None:
|
||||
self.symbols = []
|
||||
self.symnum = int(symtab_sz / symtab_entsize)
|
||||
self.entsize = symtab_entsize
|
||||
|
||||
|
||||
self.strings = strtab_buf
|
||||
self.strings_sz = strtab_sz
|
||||
|
||||
@@ -617,14 +626,18 @@ class SymTab:
|
||||
|
||||
def _parse(self, endian: str, bitness: int, symtab_buf: bytes) -> None:
|
||||
"""
|
||||
return the symbol's information in
|
||||
return the symbol's information in
|
||||
the order specified by sys/elf32.h
|
||||
"""
|
||||
for i in range(self.symnum):
|
||||
if bitness == 32:
|
||||
name, value, size, info, other, shndx = struct.unpack_from(endian+"IIIBBH", symtab_buf, i*self.entsize)
|
||||
name, value, size, info, other, shndx = struct.unpack_from(
|
||||
endian + "IIIBBH", symtab_buf, i * self.entsize
|
||||
)
|
||||
elif bitness == 64:
|
||||
name, info, other, shndx, value, size = struct.unpack_from(endian+"IBBBQQ", symtab_buf, i*self.entsize)
|
||||
name, info, other, shndx, value, size = struct.unpack_from(
|
||||
endian + "IBBBQQ", symtab_buf, i * self.entsize
|
||||
)
|
||||
|
||||
self.symbols.append((name, value, size, info, other, shndx))
|
||||
|
||||
@@ -780,7 +793,7 @@ def guess_os_from_symtab(elf) -> Optional[OS]:
|
||||
|
||||
for shdr in elf.section_headers:
|
||||
if shdr.type == SHT_STRTAB:
|
||||
strtab_buf, strtab_sz= shdr.buf, shdr.size
|
||||
strtab_buf, strtab_sz = shdr.buf, shdr.size
|
||||
|
||||
elif shdr.type == SHT_SYMTAB:
|
||||
symtab_buf, symtab_entsize, symtab_sz = shdr.buf, shdr.entsize, shdr.size
|
||||
@@ -789,22 +802,23 @@ def guess_os_from_symtab(elf) -> Optional[OS]:
|
||||
# executable does not contain a symbol table
|
||||
# or the symbol's names are stripped
|
||||
return None
|
||||
|
||||
symtab = SymTab(
|
||||
elf.endian, elf.bitness, symtab_buf, symtab_entsize, symtab_sz, strtab_buf, strtab_sz
|
||||
)
|
||||
|
||||
symtab = SymTab(elf.endian, elf.bitness, symtab_buf, symtab_entsize, symtab_sz, strtab_buf, strtab_sz)
|
||||
|
||||
keywords = {
|
||||
OS.LINUX: ['linux', '/linux/',],
|
||||
OS.LINUX: [
|
||||
"linux",
|
||||
"/linux/",
|
||||
],
|
||||
}
|
||||
|
||||
|
||||
for name, *_ in symtab.get_symbols():
|
||||
sym_name = symtab.fetch_str(name)
|
||||
|
||||
for os, hints in keywords.items():
|
||||
if any(map(lambda x: x in sym_name, hints)):
|
||||
return os
|
||||
|
||||
|
||||
return None
|
||||
|
||||
|
||||
@@ -832,7 +846,7 @@ def detect_elf_os(f) -> str:
|
||||
needed_dependencies_guess = guess_os_from_needed_dependencies(elf)
|
||||
logger.debug("guess: needed dependencies: %s", needed_dependencies_guess)
|
||||
|
||||
symtab_guess = guess_os_from_symtab(elf)
|
||||
symtab_guess = guess_os_from_symtab(elf)
|
||||
logger.debug("guess: pertinent symbol name: %s", symtab_guess)
|
||||
|
||||
ret = None
|
||||
|
||||
@@ -92,7 +92,7 @@ def get_file_imports() -> Dict[int, Tuple[str, str, int]]:
|
||||
|
||||
# IDA uses section names for the library of ELF imports, like ".dynsym".
|
||||
# These are not useful to us, we may need to expand this list over time
|
||||
# TODO: exhaust this list, see #1419
|
||||
# TODO: exhaust this list, see #1419
|
||||
if library == ".dynsym":
|
||||
library = ""
|
||||
|
||||
|
||||
Reference in New Issue
Block a user