Skip to content

Commit 3bb5754

Browse files
Update elffile.py
1 parent dd2eef5 commit 3bb5754

File tree

1 file changed

+24
-9
lines changed

1 file changed

+24
-9
lines changed

capa/features/extractors/elffile.py

Lines changed: 24 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -35,10 +35,16 @@ def extract_file_export_names(elf: ELFFile, **kwargs):
3535
for symbol in section.iter_symbols():
3636
# The following conditions are based on the following article
3737
# http://www.m4b.io/elf/export/binary/analysis/2015/05/25/what-is-an-elf-export.html
38-
if symbol.name and symbol.entry.st_info.type in ["STT_FUNC", "STT_OBJECT", "STT_IFUNC"]:
39-
if symbol.entry.st_value != 0 and symbol.entry.st_shndx != "SHN_UNDEF":
40-
# Export symbol
41-
yield Export(symbol.name), AbsoluteVirtualAddress(symbol.entry.st_value)
38+
if not symbol.name:
39+
continue
40+
if symbol.entry.st_info.type not in ["STT_FUNC", "STT_OBJECT", "STT_IFUNC"]:
41+
continue
42+
if symbol.entry.st_value == 0:
43+
continue
44+
if symbol.entry.st_shndx == "SHN_UNDEF":
45+
continue
46+
47+
yield Export(symbol.name), AbsoluteVirtualAddress(symbol.entry.st_value)
4248

4349

4450
def extract_file_import_names(elf: ELFFile, **kwargs):
@@ -55,11 +61,20 @@ def extract_file_import_names(elf: ELFFile, **kwargs):
5561
for symbol in section.iter_symbols():
5662
# The following conditions are based on the following article
5763
# http://www.m4b.io/elf/export/binary/analysis/2015/05/25/what-is-an-elf-export.html
58-
if symbol.name and symbol.entry.st_info.type in ["STT_FUNC", "STT_OBJECT", "STT_IFUNC"]:
59-
if symbol.entry.st_value == 0 and symbol.entry.st_shndx == "SHN_UNDEF" and symbol.entry.st_name != 0:
60-
# TODO(williballenthin): extract symbol address
61-
# https://github.com/mandiant/capa/issues/1608
62-
yield Import(symbol.name), FileOffsetAddress(0x0)
64+
if not symbol.name:
65+
continue
66+
if symbol.entry.st_info.type not in ["STT_FUNC", "STT_OBJECT", "STT_IFUNC"]:
67+
continue
68+
if symbol.entry.st_value != 0:
69+
continue
70+
if symbol.entry.st_shndx != "SHN_UNDEF":
71+
continue
72+
if symbol.entry.st_name == 0:
73+
continue
74+
75+
# TODO(williballenthin): extract symbol address
76+
# https://github.com/mandiant/capa/issues/1608
77+
yield Import(symbol.name), FileOffsetAddress(0x0)
6378

6479

6580
def extract_file_section_names(elf, **kwargs):

0 commit comments

Comments
 (0)