vee1e/capa
1
0
Fork 0
mirror of https://github.com/vee1e/capa.git synced 2026-09-01 18:57:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: ghidra: don't emit VAs for embedded PEs

Browse source
This commit is contained in:
Willi Ballenthin 2026-05-07 12:28:10 +02:00 • committed by Willi Ballenthin
parent 330b64137e
commit 4e80400711
1 changed files with 0 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

3
capa/features/extractors/ghidra/file.py
View file

@ -86,12 +86,9 @@ def extract_file_embedded_pe() -> Iterator[tuple[Feature, Address]]:
for off, _ in find_embedded_pe(capa.features.extractors.ghidra.helpers.get_block_bytes(block), mz_xor):
ea_addr = block.getStart().add(off)
ea = ea_addr.getOffset()
f_offset = capa.features.extractors.ghidra.helpers.get_file_offset(ea_addr)
if f_offset != -1:
yield Characteristic("embedded pe"), FileOffsetAddress(f_offset)
else:
yield Characteristic("embedded pe"), AbsoluteVirtualAddress(ea)
def extract_file_export_names() -> Iterator[tuple[Feature, Address]]: