diff --git a/CHANGELOG.md b/CHANGELOG.md index 8736fd85d..bb2b8ce74 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -24,6 +24,7 @@ - extractor: fix exception when PE extractor encounters unknown architecture #2440 @Tamir-K - IDA Pro: rename ida to idapro module for plugin and idalib in IDA 9.0 #2453 @mr-tz - ghidra: fix saving of base address @mr-tz +- binja: support loading raw x86/x86_64 shellcode #2489 @xusheng6 ### capa Explorer Web diff --git a/capa/features/extractors/binja/file.py b/capa/features/extractors/binja/file.py index b3426212c..10a724176 100644 --- a/capa/features/extractors/binja/file.py +++ b/capa/features/extractors/binja/file.py @@ -13,7 +13,16 @@ import capa.features.extractors.helpers import capa.features.extractors.strings from capa.features.file import Export, Import, Section, FunctionName -from capa.features.common import FORMAT_PE, FORMAT_ELF, Format, String, Feature, Characteristic +from capa.features.common import ( + FORMAT_PE, + FORMAT_ELF, + FORMAT_SC32, + FORMAT_SC64, + Format, + String, + Feature, + Characteristic, +) from capa.features.address import NO_ADDRESS, Address, FileOffsetAddress, AbsoluteVirtualAddress from capa.features.extractors.binja.helpers import read_c_string, unmangle_c_name @@ -133,6 +142,13 @@ def extract_file_format(bv: BinaryView) -> Iterator[tuple[Feature, Address]]: yield Format(FORMAT_PE), NO_ADDRESS elif view_type == "ELF": yield Format(FORMAT_ELF), NO_ADDRESS + elif view_type == "Mapped": + if bv.arch.name == "x86": + yield Format(FORMAT_SC32), NO_ADDRESS + elif bv.arch.name == "x86_64": + yield Format(FORMAT_SC64), NO_ADDRESS + else: + raise NotImplementedError(f"unexpected raw file with arch: {bv.arch}") elif view_type == "Raw": # no file type to return when processing a binary file, but we want to continue processing return