From 9b93e90e6316d1535ffd94efeac715656d20130b Mon Sep 17 00:00:00 2001 From: Willi Ballenthin Date: Thu, 7 May 2026 12:33:01 +0200 Subject: [PATCH] fix: wrap binja function name addresses in AbsoluteVirtualAddress --- capa/features/extractors/binja/file.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/capa/features/extractors/binja/file.py b/capa/features/extractors/binja/file.py index 5d6b136a..9ca96ec7 100644 --- a/capa/features/extractors/binja/file.py +++ b/capa/features/extractors/binja/file.py @@ -135,13 +135,14 @@ def extract_file_function_names(bv: BinaryView) -> Iterator[tuple[Feature, Addre continue name = sym.short_name - yield FunctionName(name), sym.address + addr = AbsoluteVirtualAddress(sym.address) + yield FunctionName(name), addr if name.startswith("_"): # some linkers may prefix linked routines with a `_` to avoid name collisions. # extract features for both the mangled and un-mangled representations. # e.g. `_fwrite` -> `fwrite` # see: https://stackoverflow.com/a/2628384/87207 - yield FunctionName(name[1:]), sym.address + yield FunctionName(name[1:]), addr def extract_file_format(bv: BinaryView) -> Iterator[tuple[Feature, Address]]: