output/doc missing description for offsets

[mike-hunhoff]

capa match snippet:

parse PE header (8 matches)
...
function @ 0x1000B090
  or:
    and:
      mnemonic: cmp @ 0x1000B09C, 0x1000B0B8, 0x1000B12B
      or:
        number: 0x4550 = IMAGE_DOS_SIGNATURE (MZ) @ 0x1000B0B8
      or:
        number: 0x5A4D = IMAGE_NT_SIGNATURE (PE) @ 0x1000B097
    and:
      or:
        and:
          offset: 0x50 @ 0x1000B0D2, 0x1000B0F1
          offset: 0x34 @ 0x1000B0D5, 0x1000B1A3, 0x1000B1B0
...

rule snippet:

rule:
  meta:
    name: parse PE header
...
        - or:
          - and:  # 32-bit
            - offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage
            - offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase
...

doc snippet:

...
                      "children": [
                        {
                          "children": [],
                          "locations": [
                            268480722,
                            268480753
                          ],
                          "node": {
                            "feature": {
                              "offset": "0x50",
                              "type": "offset"
                            },
                            "type": "feature"
                          },
                          "success": true
                        },
                        {
                          "children": [],
                          "locations": [
                            268480725,
                            268480931,
                            268480944
                          ],
                          "node": {
                            "feature": {
                              "offset": "0x34",
                              "type": "offset"
                            },
                            "type": "feature"
                          },
                          "success": true
                        }
                      ],
...

[williballenthin]

i think this information is here

[williballenthin]

vverbose mode renders using the json, so if its able to emit the description, then it must be somewhere in the json.

can you share more details on where this info is missing?

[mike-hunhoff]

For this specific case I was referring to the descriptions included with the following two offsets specified in the rule parse PE header (I mistakenly specified number constants before 🤦):

• - offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage
• - offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase

The above offsets are matched but the descriptions are not displayed in capa's output:

...
        and:
          offset: 0x50 @ 0x1000B0D2, 0x1000B0F1
          offset: 0x34 @ 0x1000B0D5, 0x1000B1A3, 0x1000B1B0
...

Nor are the descriptions included in the JSON output:

...
                      "children": [
                        {
                          "children": [],
                          "locations": [
                            268480722,
                            268480753
                          ],
                          "node": {
                            "feature": {
                              "offset": "0x50",
                              "type": "offset"
                            },
                            "type": "feature"
                          },
                          "success": true
                        },
                        {
                          "children": [],
                          "locations": [
                            268480725,
                            268480931,
                            268480944
                          ],
                          "node": {
                            "feature": {
                              "offset": "0x34",
                              "type": "offset"
                            },
                            "type": "feature"
                          },
                          "success": true
                        }
                      ],
...

I would expect the descriptions IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage and IMAGE_NT_HEADERS.OptionalHeader.ImageBase to be included.

[williballenthin]

can you share the command you're using to get this output (primarily looking for the sample hash)

edit: non-public hash shared with me via PM

[williballenthin]

sorry, i didn't notice that the descriptions didn't match in your original post. i do see there is a description in the vverbose output, but it doesn't match whats provided by the rule?

[williballenthin]

passing the description was missing here:

[williballenthin]

looks better now

[williballenthin]

@Ana06