From 106123eb619baad20e2233f70f32c446b60858e0 Mon Sep 17 00:00:00 2001 From: Moritz Date: Fri, 27 Jan 2023 09:56:12 +0100 Subject: [PATCH] Rules for the week (#671) * add rules * avoid FPs via mnemonics to ignore * correct number logic * add --onefile option strings --- compiler/nuitka/compiled-with-nuitka.yml | 22 +++++++++----- .../rc4/encrypt-data-using-rc4-ksa.yml | 29 ++++++++++++------- .../resource/access-dotnet-resource.yml | 15 ++++++++++ .../linked-against-cpp-standard-library.yml | 16 ++++++++++ 4 files changed, 65 insertions(+), 17 deletions(-) create mode 100644 executable/resource/access-dotnet-resource.yml create mode 100644 linking/static/linked-against-cpp-standard-library.yml diff --git a/compiler/nuitka/compiled-with-nuitka.yml b/compiler/nuitka/compiled-with-nuitka.yml index 206cad50..5953a6bb 100644 --- a/compiler/nuitka/compiled-with-nuitka.yml +++ b/compiler/nuitka/compiled-with-nuitka.yml @@ -4,14 +4,22 @@ rule: namespace: compiler/nuitka authors: - "@williballenthin" + - "@mr-tz" scope: file examples: - 39ce034911a6ebd482af5893f9bdbd95 features: - - and: - # https://github.com/Nuitka/Nuitka/blob/f87667fec2748a735834fc699daa20cedfb8f2c7/nuitka/build/static_src/InspectPatcher.c#L218 - - string: "nuitka_types_patch" - # https://github.com/Nuitka/Nuitka/blob/f87667fec2748a735834fc699daa20cedfb8f2c7/nuitka/build/static_src/MetaPathBasedLoader.c#L1173 - - string: "O:is_package" - # https://github.com/Nuitka/Nuitka/blob/f87667fec2748a735834fc699daa20cedfb8f2c7/nuitka/build/static_src/HelpersConstantsBlob.c#L1229 - - string: "Error, corrupted constants object" + - or: + - and: + # https://github.com/Nuitka/Nuitka/blob/f87667fec2748a735834fc699daa20cedfb8f2c7/nuitka/build/static_src/InspectPatcher.c#L218 + - string: "nuitka_types_patch" + # https://github.com/Nuitka/Nuitka/blob/f87667fec2748a735834fc699daa20cedfb8f2c7/nuitka/build/static_src/MetaPathBasedLoader.c#L1173 + - string: "O:is_package" + # https://github.com/Nuitka/Nuitka/blob/f87667fec2748a735834fc699daa20cedfb8f2c7/nuitka/build/static_src/HelpersConstantsBlob.c#L1229 + - string: "Error, corrupted constants object" + - and: + - description: binary created using --onefile option + # https://github.com/Nuitka/Nuitka/blob/ada92366675bd9c797359a260667545d53ef62fb/nuitka/build/static_src/OnefileBootstrap.c#L199 + - string: "NUITKA_ONEFILE_PARENT" + # https://github.com/Nuitka/Nuitka/blob/ada92366675bd9c797359a260667545d53ef62fb/nuitka/build/static_src/OnefileBootstrap.c#L136 + - string: "Error, couldn't runtime expand temporary files." diff --git a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml index b9255b2f..516444e2 100644 --- a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml +++ b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml @@ -12,9 +12,8 @@ rule: - Cryptography::Encryption Key::RC4 KSA [C0028.002] examples: - 34404A3FB9804977C6AB86CB991FB130:0x403D40 - - C805528F6844D7CAF5793C025B56F67D:0x4067AE - 9324D1A8AE37A36AE560C37448C9705A:0x404950 - - 782A48821D88060ADF0F7EF3E8759FEE3DDAD49E942DAAD18C5AF8AE0E9EB51E:0x405C42 + - 2B8BEC5BCB1777EAA155D832F7AFC797:0x405C42 - 73CE04892E5F39EC82B00C02FC04C70F:0x40646E features: - or: @@ -29,19 +28,29 @@ rule: - number: 0xFF - number: 0x100 - or: + - description: modulo 256 - match: calculate modulo 256 via x86 assembly - # compiler may do this via zero-extended mov from 8-bit register - - count(mnemonic(movzx)): 2 or more + - basic block: + - and: + - description: modulo via zero-extended mov from 8-bit register + - count(mnemonic(movzx)): 2 or more + # avoid false positives; filter out unexpected instructions + - not: + - or: + - mnemonic: shl + - mnemonic: rol + - characteristic: nzxor - or: - description: modulo key length - mnemonic: div - mnemonic: idiv - and: - - description: optimized, writes DWORDs instead of bytes - - instruction: - - mnemonic: sub + - description: write DWORDs instead of bytes + - or: + - number: 0x03020100 - number: 0xFFFEFDFC - instruction: - - mnemonic: add - - number: 0x03020100 - - number: 0x4040404 + - or: + - mnemonic: add + - mnemonic: sub + - number: 0x04040404 diff --git a/executable/resource/access-dotnet-resource.yml b/executable/resource/access-dotnet-resource.yml new file mode 100644 index 00000000..93aaf14e --- /dev/null +++ b/executable/resource/access-dotnet-resource.yml @@ -0,0 +1,15 @@ +rule: + meta: + name: access .NET resource + namespace: executable/resource + authors: + - "@mr-tz" + scope: function + examples: + - 387f15043f0198fd3a637b0758c2b6dde9ead795c3ed70803426fc355731b173:0x06000084 + features: + - and: + - format: dotnet + - or: + - api: System.Resources.ResourceManager::ctor + - api: System.Reflection.Assembly::GetManifestResourceStream diff --git a/linking/static/linked-against-cpp-standard-library.yml b/linking/static/linked-against-cpp-standard-library.yml new file mode 100644 index 00000000..e7682397 --- /dev/null +++ b/linking/static/linked-against-cpp-standard-library.yml @@ -0,0 +1,16 @@ +rule: + meta: + name: linked against CPP standard library + namespace: linking/static + authors: + - "@mr-tz" + scope: file + references: + - https://en.wikipedia.org/wiki/P._J._Plauger + - https://www.dinkumware.com/ + examples: + - 03b236b23b1ec37c663527c1f53af3fe + features: + - or: + - string: "Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED." + - string: "Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED."