Skip to content

fix(freeze): use get_base_address in dumps_dynamic - #2943

Merged
williballenthin merged 1 commit into
mandiant:masterfrom
blenbot:fix_typo_dynamic_dumps
Mar 18, 2026
Merged

fix(freeze): use get_base_address in dumps_dynamic#2943
williballenthin merged 1 commit into
mandiant:masterfrom
blenbot:fix_typo_dynamic_dumps

Conversation

@blenbot

@blenbot blenbot commented Mar 18, 2026

Copy link
Copy Markdown
Contributor

Summary

While going through freeze in __init__.py I found that dumps_dynamic expects a DynamicFeatureExtractor and it was doing this to get base_address: get_base_addr = getattr(extractor, "get_base_addr", None) but upon examining extractors(cape, drakvuf, vmray) which subclasses DynamicFeatureExtractor, I noticed all of them have an attribute named get_base_address not get_base_addr.

Problem

  • This caused fallback to NO_ADDRESS in all cases and loss of base address information.

Changes

  • Update dynamic freeze serialization to call/use get_base_address().

Checklist

  • No CHANGELOG update needed
  • No new tests needed
  • No documentation update needed
  • This submission includes AI-generated code and I have provided details in the description.

Signed-off-by: blenbot <harshitiszz23@gmail.com>
@gemini-code-assist

Copy link
Copy Markdown
Contributor

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a critical issue in the dynamic feature serialization process where the base address was not being correctly retrieved. By updating the attribute name used to fetch the base address, the change ensures that dynamic features are serialized with accurate address information, preventing the loss of this crucial data.

Highlights

  • Fix dumps_dynamic base address retrieval: Corrected the attribute name from get_base_addr to get_base_address when serializing dynamic features, ensuring the correct base address is used instead of falling back to NO_ADDRESS.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request correctly fixes a bug in dumps_dynamic where an incorrect attribute name get_base_addr was used to fetch the base address, causing it to always fall back to NO_ADDRESS. The change to use get_base_address aligns with the implementation in dynamic feature extractors. I've added one suggestion to improve code clarity by renaming a local variable for consistency.

Comment on lines +546 to 547
get_base_addr = getattr(extractor, "get_base_address", None)
base_addr = get_base_addr() if get_base_addr else capa.features.address.NO_ADDRESS

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

While this change correctly fixes the bug by using get_base_address, the local variable get_base_addr is now inconsistently named. It would be clearer to rename it to get_base_address to match the method name being retrieved.

Suggested change
get_base_addr = getattr(extractor, "get_base_address", None)
base_addr = get_base_addr() if get_base_addr else capa.features.address.NO_ADDRESS
get_base_address = getattr(extractor, "get_base_address", None)
base_addr = get_base_address() if get_base_address else capa.features.address.NO_ADDRESS

@williballenthin williballenthin left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nice find!

@williballenthin
williballenthin merged commit 6579e01 into mandiant:master Mar 18, 2026
2 checks passed
@williballenthin

Copy link
Copy Markdown
Collaborator

thanks @blenbot!

@blenbot
blenbot deleted the fix_typo_dynamic_dumps branch March 20, 2026 19:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants