Rules for the week (#671)

* add rules

* avoid FPs via mnemonics to ignore

* correct number logic

* add --onefile option strings

compiler/nuitka/compiled-with-nuitka.yml

@@ -4,14 +4,22 @@ rule:
     namespace: compiler/nuitka
     authors:
       - "@williballenthin"
+      - "@mr-tz"
     scope: file
     examples:
       - 39ce034911a6ebd482af5893f9bdbd95
   features:
-    - and:
-      # https://github.com/Nuitka/Nuitka/blob/f87667fec2748a735834fc699daa20cedfb8f2c7/nuitka/build/static_src/InspectPatcher.c#L218
-      - string: "nuitka_types_patch"
-      # https://github.com/Nuitka/Nuitka/blob/f87667fec2748a735834fc699daa20cedfb8f2c7/nuitka/build/static_src/MetaPathBasedLoader.c#L1173
-      - string: "O:is_package"
-      # https://github.com/Nuitka/Nuitka/blob/f87667fec2748a735834fc699daa20cedfb8f2c7/nuitka/build/static_src/HelpersConstantsBlob.c#L1229
-      - string: "Error, corrupted constants object"
+    - or:
+      - and:
+        # https://github.com/Nuitka/Nuitka/blob/f87667fec2748a735834fc699daa20cedfb8f2c7/nuitka/build/static_src/InspectPatcher.c#L218
+        - string: "nuitka_types_patch"
+        # https://github.com/Nuitka/Nuitka/blob/f87667fec2748a735834fc699daa20cedfb8f2c7/nuitka/build/static_src/MetaPathBasedLoader.c#L1173
+        - string: "O:is_package"
+        # https://github.com/Nuitka/Nuitka/blob/f87667fec2748a735834fc699daa20cedfb8f2c7/nuitka/build/static_src/HelpersConstantsBlob.c#L1229
+        - string: "Error, corrupted constants object"
+      - and:
+        - description: binary created using --onefile option
+        # https://github.com/Nuitka/Nuitka/blob/ada92366675bd9c797359a260667545d53ef62fb/nuitka/build/static_src/OnefileBootstrap.c#L199
+        - string: "NUITKA_ONEFILE_PARENT"
+        # https://github.com/Nuitka/Nuitka/blob/ada92366675bd9c797359a260667545d53ef62fb/nuitka/build/static_src/OnefileBootstrap.c#L136
+        - string: "Error, couldn't runtime expand temporary files."

data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml

@@ -12,9 +12,8 @@ rule:
       - Cryptography::Encryption Key::RC4 KSA [C0028.002]
     examples:
       - 34404A3FB9804977C6AB86CB991FB130:0x403D40
-      - C805528F6844D7CAF5793C025B56F67D:0x4067AE
       - 9324D1A8AE37A36AE560C37448C9705A:0x404950
-      - 782A48821D88060ADF0F7EF3E8759FEE3DDAD49E942DAAD18C5AF8AE0E9EB51E:0x405C42
+      - 2B8BEC5BCB1777EAA155D832F7AFC797:0x405C42
       - 73CE04892E5F39EC82B00C02FC04C70F:0x40646E
   features:
     - or:
@@ -29,19 +28,29 @@ rule:
               - number: 0xFF
               - number: 0x100
         - or:
+          - description: modulo 256
           - match: calculate modulo 256 via x86 assembly
-          # compiler may do this via zero-extended mov from 8-bit register
-          - count(mnemonic(movzx)): 2 or more
+          - basic block:
+            - and:
+              - description: modulo via zero-extended mov from 8-bit register
+              - count(mnemonic(movzx)): 2 or more
+              # avoid false positives; filter out unexpected instructions
+              - not:
+                - or:
+                  - mnemonic: shl
+                  - mnemonic: rol
+                  - characteristic: nzxor
         - or:
           - description: modulo key length
           - mnemonic: div
           - mnemonic: idiv
       - and:
-        - description: optimized, writes DWORDs instead of bytes
-        - instruction:
-          - mnemonic: sub
+        - description: write DWORDs instead of bytes
+        - or:
+          - number: 0x03020100
           - number: 0xFFFEFDFC
         - instruction:
-          - mnemonic: add
-          - number: 0x03020100
-        - number: 0x4040404
+          - or:
+            - mnemonic: add
+            - mnemonic: sub
+          - number: 0x04040404

executable/resource/access-dotnet-resource.yml

@@ -0,0 +1,15 @@
+rule:
+  meta:
+    name: access .NET resource
+    namespace: executable/resource
+    authors:
+      - "@mr-tz"
+    scope: function
+    examples:
+      - 387f15043f0198fd3a637b0758c2b6dde9ead795c3ed70803426fc355731b173:0x06000084
+  features:
+    - and:
+      - format: dotnet
+      - or:
+        - api: System.Resources.ResourceManager::ctor
+        - api: System.Reflection.Assembly::GetManifestResourceStream

linking/static/linked-against-cpp-standard-library.yml

@@ -0,0 +1,16 @@
+rule:
+  meta:
+    name: linked against CPP standard library
+    namespace: linking/static
+    authors:
+      - "@mr-tz"
+    scope: file
+    references:
+      - https://en.wikipedia.org/wiki/P._J._Plauger
+      - https://www.dinkumware.com/
+    examples:
+      - 03b236b23b1ec37c663527c1f53af3fe
+  features:
+    - or:
+      - string: "Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED."
+      - string: "Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED."