From 745cb037d4aef8efb64ad14deaec049a9ee35987 Mon Sep 17 00:00:00 2001 From: Willi Ballenthin Date: Mon, 11 May 2026 09:11:40 +0200 Subject: [PATCH] rules: parse operand features --- capa/rules/__init__.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/capa/rules/__init__.py b/capa/rules/__init__.py index dd3218b2..2c9191ff 100644 --- a/capa/rules/__init__.py +++ b/capa/rules/__init__.py @@ -21,6 +21,7 @@ import uuid import struct import logging import binascii +import functools import collections from enum import Enum from typing import Any, Union, Callable, Iterator, Optional, cast @@ -444,6 +445,12 @@ def parse_feature(key: str): return capa.features.common.Namespace elif key == "property": return capa.features.insn.Property + elif key.startswith("operand[") and key.endswith("].number"): + index = int(key[len("operand[") : -len("].number")]) + return functools.partial(capa.features.insn.OperandNumber, index) + elif key.startswith("operand[") and key.endswith("].offset"): + index = int(key[len("operand[") : -len("].offset")]) + return functools.partial(capa.features.insn.OperandOffset, index) else: raise InvalidRule(f"unexpected statement: {key}")