gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2026-02-04 19:12:01 -08:00
Code Issues Packages Projects Releases Wiki Activity

os: detect Android via dependencies, too

Browse Source
This commit is contained in:
Willi Ballenthin
2023-08-14 10:27:19 +00:00
committed by GitHub
parent 18058beb0a
commit e6cb3d3b3b
3 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
capa/features/extractors/elf.py
View File

@@ -861,6 +861,8 @@ def guess_os_from_needed_dependencies(elf: ELF) -> Optional[OS]:
return OS.HURD
if needed.startswith("libhurduser.so"):
return OS.HURD
if needed.startswith("libandroid.so"):
return OS.ANDROID
return None

2
tests/fixtures.py
View File

@@ -308,6 +308,8 @@ def get_data_path_by_name(name) -> Path:
return CD / "data" / "2bf18d0403677378adad9001b1243211.elf_"
elif name.startswith("ea2876"):
return CD / "data" / "ea2876e9175410b6f6719f80ee44b9553960758c7d0f7bed73c0fe9a78d8e669.dll_"
elif name.startswith("1038a2"):
return CD / "data" / "1038a23daad86042c66bfe6c9d052d27048de9653bde5750dc0f240c792d9ac8.elf_"
else:
raise ValueError(f"unexpected sample fixture: {name}")

12
tests/test_os_detection.py
View File

@@ -80,6 +80,18 @@ def test_elf_symbol_table():
assert capa.features.extractors.elf.detect_elf_os(f) == "linux"
def test_elf_android_notes():
# DEBUG:capa.features.extractors.elf:guess: osabi: None
# DEBUG:capa.features.extractors.elf:guess: ph notes: OS.ANDROID
# DEBUG:capa.features.extractors.elf:guess: sh notes: None
# DEBUG:capa.features.extractors.elf:guess: linker: None
# DEBUG:capa.features.extractors.elf:guess: ABI versions needed: None
# DEBUG:capa.features.extractors.elf:guess: needed dependencies: OS.ANDROID
path = get_data_path_by_name("1038a2")
with Path(path).open("rb") as f:
assert capa.features.extractors.elf.detect_elf_os(f) == "android"
def test_elf_parse_capa_pyinstaller_header():
# error after misidentified large pydata section with address 0; fixed in #1454
# compressed ELF header of capa-v5.1.0-linux