Skip to content

ida: show addresses for file level features in rulegen#3009

Open
vee1e wants to merge 6 commits intomandiant:masterfrom
vee1e:fix/1523-display-addresses-files
Open

ida: show addresses for file level features in rulegen#3009
vee1e wants to merge 6 commits intomandiant:masterfrom
vee1e:fix/1523-display-addresses-files

Conversation

@vee1e
Copy link
Copy Markdown

@vee1e vee1e commented Apr 15, 2026

This PR fixes address handling for file-scope features in the IDA rule generator tree.

Closes #1523

  • FileOffsetAddress values now render as file:0x... in the rule generator Address column.
  • VA-range filtering now treats file:... values as non-VA and avoids parse errors.

Visuals (highlighted in yellow box)

Using al-khaser_x86.exe

image

Checklist

  • No CHANGELOG update needed
  • No new tests needed
  • No documentation update needed
  • This submission includes AI-generated code and I have provided details in the description.

AI usage disclosure

OpenCode with openai/gpt-5.3-codex to help draft and apply code updates.

@devs6186's code in #2904 was also used as a reference.

Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request enhances the capa IDA Pro plugin by introducing support for file-scope feature addresses, allowing them to be displayed as file:0x... in the rule generator tree. The changes include logic to resolve these file offsets to virtual addresses for navigation and updates to the filtering mechanism to handle the new address format safely. A review comment suggests a minor optimization in the address formatting logic to remove a redundant integer conversion.

Comment thread capa/ida/plugin/view.py Outdated
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

explorer: display addresses for rule generator file features

2 participants