Broken offset matching in IDA

[Still34]

Description

During the development of rules for donut-related rules, it is discovered that offset keyword does not match instructions that should match per capa's specs. When investigated, I found out that the offset matching behavior within capa standalone and IDA capa explorer differs. At the moment, the offset matching works in capa standalone but not within IDA.

Steps to Reproduce

1. Open shellcode sample referenced in Add rules for detecting donut-related features capa-rules#997 in IDA
2. Open capa explorer
3. Wait for analysis results

Expected behavior:

Rules that use the offset keyword to match the relevant instructions

Actual behavior:

Sample does not match the offset keyword defined within the rule

Versions

• capa 9.1.0 (3bd3395)
• IDA Pro 9.0.241217
• vivisect
  viv_utils 0.8.0
  vivisect 1.2.1

Additional Information