unexpected address type in verbose mode during dynamic analysis

[williballenthin]

@williballenthin ➜ /workspaces/capa (dynamic-feature-extraction) $ python -m capa.main -r rules1 tests/data/dynamic/cape/v2.2/d46900384c78863420fb3e297d0a2f743cd2b6b3f7f82bf64059a168e07aceb7.json -v
Traceback (most recent call last):
  File "/usr/local/lib/python3.10/runpy.py", line 196, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "/usr/local/lib/python3.10/runpy.py", line 86, in _run_code
    exec(code, run_globals)
  File "/workspaces/capa/capa/main.py", line 1655, in <module>
    sys.exit(main())
  File "/workspaces/capa/capa/main.py", line 1601, in main
    print(capa.render.verbose.render(meta, rules, capabilities))
  File "/workspaces/capa/capa/render/verbose.py", line 236, in render
    return render_verbose(rd.ResultDocument.from_capa(meta, rules, capabilities))
  File "/workspaces/capa/capa/render/verbose.py", line 229, in render_verbose
    render_rules(ostream, doc)
  File "/workspaces/capa/capa/render/verbose.py", line 214, in render_rules
    rows.append(("matches", "\n".join(map(format_address, locations))))
  File "/workspaces/capa/capa/render/verbose.py", line 77, in format_address
    raise ValueError("unexpected address type")
ValueError: unexpected address type

d46900384c78863420fb3e297d0a2f743cd2b6b3f7f82bf64059a168e07aceb7 from v2.2 archive in #1698

• add test demonstrating rendering of the currently broken address type
• fix the issue

[williballenthin]

same error in vverbose mode

[williballenthin]

maybe missing CallAddress here:

capa/capa/render/verbose.py

Lines 57 to 74 in 19495f6

	elif address.type == frz.AddressType.DYNAMIC:
	assert isinstance(address.value, tuple)
	id_, return_address = address.value
	assert isinstance(id_, int)
	assert isinstance(return_address, int)
	return f"event: {id_}, retaddr: 0x{return_address:x}"
	elif address.type == frz.AddressType.PROCESS:
	assert isinstance(address.value, tuple)
	ppid, pid = address.value
	assert isinstance(ppid, int)
	assert isinstance(pid, int)
	return f"process ppid: {ppid}, process pid: {pid}"
	elif address.type == frz.AddressType.THREAD:
	assert isinstance(address.value, int)
	tid = address.value
	assert isinstance(tid, int)
	return f"thread id: {tid}"
	elif address.type == frz.AddressType.NO_ADDRESS:

[williballenthin]

closed in #1709