Repository: mandiant/capa
File: capa/features/extractors/viv/insn.py (Python)

Code before:
    for oper in insn.opers:
        if isinstance(oper, envi.archs.i386.disasm.i386ImmOper):
            v = oper.getOperValue(oper)
        elif isinstance(oper, envi.archs.i386.disasm.i386RegMemOper):
            # handle case like:
            #   movzx   ecx, ds:byte_423258[eax]
            v = oper.disp
        elif isinstance(oper, envi.archs.i386.disasm.i386SibOper):
            # like 0x401000 in `mov eax, 0x401000[2 * ebx]`
            v = oper.imm
        elif isinstance(oper, envi.archs.amd64.disasm.Amd64RipRelOper):
            # see: Lab21-01.exe_:0x1400010D3
            v = oper.getOperAddr(insn)
        else:
            continue

        for v in derefs(f.vw, v):
            try:
                buf = read_bytes(f.vw, v)
            except envi.exc.SegmentationViolation:
                continue

            if capa.features.extractors.helpers.all_zeros(buf):
                continue

            if f.vw.isProbablyString(v) or f.vw.detectUnicode(v):
                # don't extract byte features for obvious strings
                continue

            yield Bytes(buf), ih.address


def read_string(vw, offset: int) -> str:
    try:
        alen = vw.detectString(offset)
    except envi.exc.SegmentationViolation:
        pass
    else:
        if alen > 0:
            buf = read_memory(vw, offset, alen)
            if b"\x00" in buf:
                # account for bug #1271.
                # remove when vivisect is fixed.
                buf = buf.partition(b"\x00")[0]
            return buf.decode("utf-8")

    try:
        ulen = vw.detectUnicode(offset)
    except envi.exc.SegmentationViolation:
        pass
    except IndexError:

Review comment (suggestion):
```suggestion
            if f.vw.isProbablyString(v) or f.vw.isProbablyUnicode(v):
```

https://github.com/vivisect/vivisect/blob/91e8419a861f49779f18316f155311967e696836/vivisect/__init__.py#L1113

Code after:
    f: viv_utils.Function = fh.inner

    if insn.mnem == "call":
        return

    for oper in insn.opers:
        if isinstance(oper, envi.archs.i386.disasm.i386ImmOper):
            v = oper.getOperValue(oper)
        elif isinstance(oper, envi.archs.i386.disasm.i386RegMemOper):
            # handle case like:
            #   movzx   ecx, ds:byte_423258[eax]
            v = oper.disp
        elif isinstance(oper, envi.archs.i386.disasm.i386SibOper):
            # like 0x401000 in `mov eax, 0x401000[2 * ebx]`
            v = oper.imm
        elif isinstance(oper, envi.archs.amd64.disasm.Amd64RipRelOper):
            # see: Lab21-01.exe_:0x1400010D3
            v = oper.getOperAddr(insn)
        else:
            continue

        for v in derefs(f.vw, v):
            try:
                buf = read_bytes(f.vw, v)
            except envi.exc.SegmentationViolation:
                continue

            if capa.features.extractors.helpers.all_zeros(buf):
                continue

            if f.vw.isProbablyString(v) or f.vw.isProbablyUnicode(v):
                # don't extract byte features for obvious strings
                continue

            yield Bytes(buf), ih.address


def read_string(vw, offset: int) -> str:
    try:
        alen = vw.detectString(offset)
    except envi.exc.SegmentationViolation:
        pass
    else:
        if alen > 0:
            buf = read_memory(vw, offset, alen)
            if b"\x00" in buf:
                # account for bug #1271.
                # remove when vivisect is fixed.
                buf = buf.partition(b"\x00")[0]
            return buf.decode("utf-8")