vee1e/capa
1
0
Fork 0
mirror of https://github.com/vee1e/capa.git synced 2026-09-01 18:57:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: wrap binja function name addresses in AbsoluteVirtualAddress

Browse source
This commit is contained in:
Willi Ballenthin 2026-05-07 12:33:01 +02:00 • committed by Willi Ballenthin
parent 4e80400711
commit 9b93e90e63
1 changed files with 3 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
capa/features/extractors/binja/file.py
View file

@ -135,13 +135,14 @@ def extract_file_function_names(bv: BinaryView) -> Iterator[tuple[Feature, Addre
continue
name = sym.short_name
yield FunctionName(name), sym.address
addr = AbsoluteVirtualAddress(sym.address)
yield FunctionName(name), addr
if name.startswith("_"):
# some linkers may prefix linked routines with a `_` to avoid name collisions.
# extract features for both the mangled and un-mangled representations.
# e.g. `_fwrite` -> `fwrite`
# see: https://stackoverflow.com/a/2628384/87207
yield FunctionName(name[1:]), sym.address
yield FunctionName(name[1:]), addr
def extract_file_format(bv: BinaryView) -> Iterator[tuple[Feature, Address]]: