vee1e/capa
1
0
Fork 0
mirror of https://github.com/vee1e/capa.git synced 2026-09-01 18:57:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

rules: parse operand features

Browse source
This commit is contained in:
Willi Ballenthin 2026-05-11 09:11:40 +02:00 • committed by Willi Ballenthin
parent 251a4e285f
commit 745cb037d4
1 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
capa/rules/__init__.py
View file

@ -21,6 +21,7 @@ import uuid
import struct
import logging
import binascii
import functools
import collections
from enum import Enum
from typing import Any, Union, Callable, Iterator, Optional, cast
@ -444,6 +445,12 @@ def parse_feature(key: str):
return capa.features.common.Namespace
elif key == "property":
return capa.features.insn.Property
elif key.startswith("operand[") and key.endswith("].number"):
index = int(key[len("operand[") : -len("].number")])
return functools.partial(capa.features.insn.OperandNumber, index)
elif key.startswith("operand[") and key.endswith("].offset"):
index = int(key[len("operand[") : -len("].offset")])
return functools.partial(capa.features.insn.OperandOffset, index)
else:
raise InvalidRule(f"unexpected statement: {key}")