From 4e80400711297bbd79901af855d2e482021e38b9 Mon Sep 17 00:00:00 2001 From: Willi Ballenthin Date: Thu, 7 May 2026 12:28:10 +0200 Subject: [PATCH] fix: ghidra: don't emit VAs for embedded PEs --- capa/features/extractors/ghidra/file.py | 3 --- 1 file changed, 3 deletions(-) diff --git a/capa/features/extractors/ghidra/file.py b/capa/features/extractors/ghidra/file.py index 5b4f1463..a9d67b8e 100644 --- a/capa/features/extractors/ghidra/file.py +++ b/capa/features/extractors/ghidra/file.py @@ -86,12 +86,9 @@ def extract_file_embedded_pe() -> Iterator[tuple[Feature, Address]]: for off, _ in find_embedded_pe(capa.features.extractors.ghidra.helpers.get_block_bytes(block), mz_xor): ea_addr = block.getStart().add(off) - ea = ea_addr.getOffset() f_offset = capa.features.extractors.ghidra.helpers.get_file_offset(ea_addr) if f_offset != -1: yield Characteristic("embedded pe"), FileOffsetAddress(f_offset) - else: - yield Characteristic("embedded pe"), AbsoluteVirtualAddress(ea) def extract_file_export_names() -> Iterator[tuple[Feature, Address]]: