@@ -35,10 +35,16 @@ def extract_file_export_names(elf: ELFFile, **kwargs):
35
35
for symbol in section .iter_symbols ():
36
36
# The following conditions are based on the following article
37
37
# http://www.m4b.io/elf/export/binary/analysis/2015/05/25/what-is-an-elf-export.html
38
- if symbol .name and symbol .entry .st_info .type in ["STT_FUNC" , "STT_OBJECT" , "STT_IFUNC" ]:
39
- if symbol .entry .st_value != 0 and symbol .entry .st_shndx != "SHN_UNDEF" :
40
- # Export symbol
41
- yield Export (symbol .name ), AbsoluteVirtualAddress (symbol .entry .st_value )
38
+ if not symbol .name :
39
+ continue
40
+ if symbol .entry .st_info .type not in ["STT_FUNC" , "STT_OBJECT" , "STT_IFUNC" ]:
41
+ continue
42
+ if symbol .entry .st_value == 0 :
43
+ continue
44
+ if symbol .entry .st_shndx == "SHN_UNDEF" :
45
+ continue
46
+
47
+ yield Export (symbol .name ), AbsoluteVirtualAddress (symbol .entry .st_value )
42
48
43
49
44
50
def extract_file_import_names (elf : ELFFile , ** kwargs ):
@@ -55,11 +61,20 @@ def extract_file_import_names(elf: ELFFile, **kwargs):
55
61
for symbol in section .iter_symbols ():
56
62
# The following conditions are based on the following article
57
63
# http://www.m4b.io/elf/export/binary/analysis/2015/05/25/what-is-an-elf-export.html
58
- if symbol .name and symbol .entry .st_info .type in ["STT_FUNC" , "STT_OBJECT" , "STT_IFUNC" ]:
59
- if symbol .entry .st_value == 0 and symbol .entry .st_shndx == "SHN_UNDEF" and symbol .entry .st_name != 0 :
60
- # TODO(williballenthin): extract symbol address
61
- # https://github.com/mandiant/capa/issues/1608
62
- yield Import (symbol .name ), FileOffsetAddress (0x0 )
64
+ if not symbol .name :
65
+ continue
66
+ if symbol .entry .st_info .type not in ["STT_FUNC" , "STT_OBJECT" , "STT_IFUNC" ]:
67
+ continue
68
+ if symbol .entry .st_value != 0 :
69
+ continue
70
+ if symbol .entry .st_shndx != "SHN_UNDEF" :
71
+ continue
72
+ if symbol .entry .st_name == 0 :
73
+ continue
74
+
75
+ # TODO(williballenthin): extract symbol address
76
+ # https://github.com/mandiant/capa/issues/1608
77
+ yield Import (symbol .name ), FileOffsetAddress (0x0 )
63
78
64
79
65
80
def extract_file_section_names (elf , ** kwargs ):
0 commit comments