diff --git a/capa/features/extractors/binja/file.py b/capa/features/extractors/binja/file.py index 5d6b136a..9ca96ec7 100644 --- a/capa/features/extractors/binja/file.py +++ b/capa/features/extractors/binja/file.py @@ -135,13 +135,14 @@ def extract_file_function_names(bv: BinaryView) -> Iterator[tuple[Feature, Addre continue name = sym.short_name - yield FunctionName(name), sym.address + addr = AbsoluteVirtualAddress(sym.address) + yield FunctionName(name), addr if name.startswith("_"): # some linkers may prefix linked routines with a `_` to avoid name collisions. # extract features for both the mangled and un-mangled representations. # e.g. `_fwrite` -> `fwrite` # see: https://stackoverflow.com/a/2628384/87207 - yield FunctionName(name[1:]), sym.address + yield FunctionName(name[1:]), addr def extract_file_format(bv: BinaryView) -> Iterator[tuple[Feature, Address]]: