capa explorer: unit test fails

[mike-hunhoff]

capa v4.0.1

FAIL mimikatz-function=0x4011FB-offset(-0x1)-True
Traceback (most recent call last):
  File "C:/Exclusions/capa-4.0.1/tests/test_ida_features.py", line 61, in test_ida_features
    fixtures.do_test_feature_presence(get_ida_extractor, sample, scope, feature, expected)
  File "C:\Exclusions/capa-4.0.1/tests\fixtures.py", line 792, in do_test_feature_presence
    assert feature.evaluate(features) == expected, msg
AssertionError: offset(-0x1) should be found in function=0x4011FB
FAIL mimikatz-function=0x4011FB-offset(-0x2)-True
Traceback (most recent call last):
  File "C:/Exclusions/capa-4.0.1/tests/test_ida_features.py", line 61, in test_ida_features
    fixtures.do_test_feature_presence(get_ida_extractor, sample, scope, feature, expected)
  File "C:\Exclusions/capa-4.0.1/tests\fixtures.py", line 792, in do_test_feature_presence
    assert feature.evaluate(features) == expected, msg
AssertionError: offset(-0x2) should be found in function=0x4011FB

[mike-hunhoff]

We appear to be emitting 64-bit displacement e.g.

movsx   eax, word ptr [edi-4]

emits

0xfffffffffffffffc

We then assume 32-bit displacement and fail to generate the correct negative.

I am unsure if this is a bug in the way we emit displacement or a bug in IDA. The IDA disassembly UI appears to use 32-bit displacement.

movsx   eax, word ptr [edi+0FFFFFFFCh]

tested 64-bit IDA >= 8.0

[mike-hunhoff]

we grab the displacement from idaapi.op_t.addr here:

capa/capa/features/extractors/ida/helpers.py

Line 224 in e6585ee

offset = op.addr

idaapi.op_t.addr docs: https://www.hex-rays.com/products/ida/support/sdkdoc/classop__t.html#acaaeff517df0b7156b4b8521a3900cdc

[mike-hunhoff]

Displacement is 32-bit in 32-bit IDA. I'm guessing ea_t is 32-bit in 32-bit IDA and 64-bit in 64-bit IDA and because ea_t is used for displacement the displacement is 64-bit (even though we assume 32-bit displacement).

[mike-hunhoff]

IDA >= 8.2 is 64-bit only so we can expect this issue to persist. We assume 32-bit displacement based on discussions here so we can simply mask the offset.