vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

loosen locality of features

Browse source
This commit is contained in:
mr-tz 2023-04-25 21:06:39 +02:00
parent 8407881020
commit 616fd90aac
1 changed files with 9 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

17
load-code/pe/enumerate-pe-sections.yml
View file

@ -4,6 +4,7 @@ rule:
namespace: load-code/pe
authors:
- "@Ana06"
- "@mr-tz"
scope: function
mbc:
- Discovery::Code Discovery::Enumerate PE Sections [B0046.001]
@ -45,11 +46,11 @@ rule:
- and:
- arch: amd64
- operand[1].offset: 0x108 = sizeof(IMAGE_NT_HEADERS64)
- basic block:
- and:
- operand[1].offset: 0xC = IMAGE_SECTION_HEADER.VirtualAddress
- operand[1].offset: 0x14 = IMAGE_SECTION_HEADER.PointerToRawData
- operand[1].offset: 0x10 = IMAGE_SECTION_HEADER.SizeOfRawData
- not:
# non-zeroing XOR was observed in FPs
- characteristic: nzxor
- 2 or more:
- operand[1].offset: 0xC = IMAGE_SECTION_HEADER.VirtualAddress
- operand[1].offset: 0x14 = IMAGE_SECTION_HEADER.PointerToRawData
- operand[1].offset: 0x10 = IMAGE_SECTION_HEADER.SizeOfRawData
# there's also offset 0x8 = IMAGE_SECTION_HEADER.Misc.PhysicalAddress, but it's likely too common
- not:
# non-zeroing XOR was observed in FPs
- characteristic: nzxor