From e4e517b334a0d8f2d6231e716b3542f35185069b Mon Sep 17 00:00:00 2001 From: Michael Hunhoff Date: Fri, 19 Feb 2021 10:07:23 -0700 Subject: [PATCH] checked for unmapped address when resolving data references --- capa/features/extractors/ida/helpers.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/capa/features/extractors/ida/helpers.py b/capa/features/extractors/ida/helpers.py index 487e6686..38fa3775 100644 --- a/capa/features/extractors/ida/helpers.py +++ b/capa/features/extractors/ida/helpers.py @@ -351,6 +351,10 @@ def find_data_reference_from_insn(insn, max_depth=10): # break if circular reference break + if not idaapi.is_mapped(data_refs[0]): + # break if address is not mapped + break + depth += 1 if depth > max_depth: # break if max depth