focus on data references only

mandiant · Dec 1, 2023 · 1374570 · 1374570
1 parent f868a75
commit 1374570
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 6 deletions.
diff --git a/capa/features/extractors/ghidra/helpers.py b/capa/features/extractors/ghidra/helpers.py
@@ -277,11 +277,11 @@ def dereference_ptr(insn: ghidra.program.database.code.InstructionDB):
         return to_deref
 
 
-def find_memory_references_from_insn(insn, max_depth: int = 10):
-    """yield memory references from given instruction"""
+def find_data_references_from_insn(insn, max_depth: int = 10):
+    """yield data references from given instruction"""
     for reference in insn.getReferencesFrom():
-        if not reference.isMemoryReference():
-            # only care about memory references
+        if not reference.getReferenceType().isData():
+            # only care about data references
             continue
 
         to_addr = reference.getToAddress()

diff --git a/capa/features/extractors/ghidra/insn.py b/capa/features/extractors/ghidra/insn.py
@@ -221,7 +221,7 @@ def extract_insn_bytes_features(fh: FunctionHandle, bb: BBHandle, ih: InsnHandle
     example:
         push    offset iid_004118d4_IShellLinkA ; riid
     """
-    for addr in capa.features.extractors.ghidra.helpers.find_memory_references_from_insn(ih.inner):
+    for addr in capa.features.extractors.ghidra.helpers.find_data_references_from_insn(ih.inner):
         data = getDataAt(addr)  # type: ignore [name-defined] # noqa: F821
         if data and not data.hasStringValue():
             extracted_bytes = capa.features.extractors.ghidra.helpers.get_bytes(addr, MAX_BYTES_FEATURE_SIZE)
@@ -236,7 +236,7 @@ def extract_insn_string_features(fh: FunctionHandle, bb: BBHandle, ih: InsnHandl
     example:
         push offset aAcr     ; "ACR  > "
     """
-    for addr in capa.features.extractors.ghidra.helpers.find_memory_references_from_insn(ih.inner):
+    for addr in capa.features.extractors.ghidra.helpers.find_data_references_from_insn(ih.inner):
         data = getDataAt(addr)  # type: ignore [name-defined] # noqa: F821
         if data and data.hasStringValue():
             yield String(data.getValue()), ih.address