Repository: mandiant/capa
File: capa/features/extractors/dnfile/helpers.py (Python)

Code before:

        # like Kernel32.dll
        if module and "." in module:
            module = module.split(".")[0]

        # like kernel32.CreateFileA
        yield DnUnmanagedMethod(token, module, method)


def get_dotnet_table_row(pe: dnfile.dnPE, table_index: int, row_index: int) -> Optional[dnfile.base.MDTableRow]:
    assert pe.net is not None
    assert pe.net.mdtables is not None

    if row_index - 1 <= 0:
        return None

    try:
        table = pe.net.mdtables.tables.get(table_index, [])
        return table[row_index - 1]
    except IndexError:
        return None


def resolve_nested_typedef_name(
    nested_class_table: dict, index: int, typedef: dnfile.mdtable.TypeDefRow, pe: dnfile.dnPE
) -> tuple[str, Tuple[str, ...]]:
    """Resolves all nested TypeDef class names. Returns the namespace as a str and the nested TypeRef name as a tuple"""

    if index in nested_class_table:
        typedef_name = []
        name = typedef.TypeName

        # Append the current typedef name
        typedef_name.append(name)

        while nested_class_table[index] in nested_class_table:
            # Iterate through the typedef table to resolve the nested name
            table_row = get_dotnet_table_row(pe, dnfile.mdtable.TypeDef.number, nested_class_table[index])
            if table_row is None:
                return typedef.TypeNamespace, tuple(typedef_name[::-1])

            name = table_row.TypeName
            typedef_name.append(name)
            index = nested_class_table[index]

        # Document the root enclosing details
        table_row = get_dotnet_table_row(pe, dnfile.mdtable.TypeDef.number, nested_class_table[index])
        if table_row is None:
            return typedef.TypeNamespace, tuple(typedef_name[::-1])

        enclosing_name = table_row.TypeName

Review comment (suggestion):
```suggestion
) -> Tuple[str, Tuple[str, ...]]:
```

Code after:

        # like Kernel32.dll
        if module and "." in module:
            module = module.split(".")[0]

        # like kernel32.CreateFileA
        yield DnUnmanagedMethod(token, module, method)


def get_dotnet_table_row(pe: dnfile.dnPE, table_index: int, row_index: int) -> Optional[dnfile.base.MDTableRow]:
    assert pe.net is not None
    assert pe.net.mdtables is not None

    if row_index - 1 <= 0:
        return None

    try:
        table = pe.net.mdtables.tables.get(table_index, [])
        return table[row_index - 1]
    except IndexError:
        return None


def resolve_nested_typedef_name(
    nested_class_table: dict, index: int, typedef: dnfile.mdtable.TypeDefRow, pe: dnfile.dnPE
) -> Tuple[str, Tuple[str, ...]]:
    """Resolves all nested TypeDef class names. Returns the namespace as a str and the nested TypeRef name as a tuple"""

    if index in nested_class_table:
        typedef_name = []
        name = typedef.TypeName

        # Append the current typedef name
        typedef_name.append(name)

        while nested_class_table[index] in nested_class_table:
            # Iterate through the typedef table to resolve the nested name
            table_row = get_dotnet_table_row(pe, dnfile.mdtable.TypeDef.number, nested_class_table[index])
            if table_row is None:
                return typedef.TypeNamespace, tuple(typedef_name[::-1])

            name = table_row.TypeName
            typedef_name.append(name)
            index = nested_class_table[index]

        # Document the root enclosing details
        table_row = get_dotnet_table_row(pe, dnfile.mdtable.TypeDef.number, nested_class_table[index])
        if table_row is None:
            return typedef.TypeNamespace, tuple(typedef_name[::-1])

        enclosing_name = table_row.TypeName