Skip to content

Commit

Permalink
binexport: number: skipped mapped numbers
Browse files Browse the repository at this point in the history
  • Loading branch information
williballenthin committed Jan 30, 2024
1 parent f318129 commit afbff1b
Showing 1 changed file with 12 additions and 1 deletion.
13 changes: 12 additions & 1 deletion capa/features/extractors/binexport2/insn.py
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,14 @@ def extract_insn_api_features(fh: FunctionHandle, _bbh: BBHandle, ih: InsnHandle
yield API(f"{library_name}.{vertex.mangled_name}"), ih.address


def probe_memory(be2: BinExport2, address: int) -> bool:
"""return True if the given address is mapped"""
for section in be2.section:
if section.address <= address < section.address + section.size:
return True
return False


def extract_insn_number_features(
fh: FunctionHandle, _bbh: BBHandle, ih: InsnHandle
) -> Iterator[Tuple[Feature, Address]]:
Expand Down Expand Up @@ -88,7 +96,10 @@ def extract_insn_number_features(

value = expression1.immediate
# TODO: skip small numbers
# TODO: skip mapped pointers

if probe_memory(be2, value):
continue

yield Number(value), ih.address


Expand Down

0 comments on commit afbff1b

Please sign in to comment.