vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

*: remove /x32 and /x64 flavors and use instruction scope

Browse source
This commit is contained in:
Willi Ballenthin 2022-04-05 12:25:14 -06:00
parent 82308c4109
commit 904bf3ef00
No known key found for this signature in database
43 changed files with 362 additions and 324 deletions
Download patch file Download diff file Expand all files Collapse all files

8
load-code/pe/enumerate-pe-sections.yml
View file

@ -25,8 +25,12 @@ rule:
- description: (DWORD)dll_raw + dos_header->e_lfanew + sizeof(IMAGE_NT_HEADERS) + sizeof(IMAGE_SECTION_HEADER) * i
- number: 0x28 = sizeof(IMAGE_SECTION_HEADER)
- or:
- offset/x32: 0xF8 = sizeof(IMAGE_NT_HEADERS32)
- offset/x64: 0x108 = sizeof(IMAGE_NT_HEADERS64)
- and:
- arch: i386
- offset: 0xF8 = sizeof(IMAGE_NT_HEADERS32)
- and:
- arch: amd64
- offset: 0x108 = sizeof(IMAGE_NT_HEADERS64)
- basic block:
- and:
- offset: 0xC = IMAGE_SECTION_HEADER.VirtualAddress

23
load-code/pe/parse-pe-header.yml
View file

@ -29,11 +29,13 @@ rule:
- offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew
- or:
- and:
- offset/x32: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage
- offset/x32: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase
- arch: i386
- offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage
- offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase
- and:
- offset/x64: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage
- offset/x64: 0x30 = IMAGE_NT_HEADERS64.OptionalHeader.ImageBase
- arch: amd64
- offset: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage
- offset: 0x30 = IMAGE_NT_HEADERS64.OptionalHeader.ImageBase
- basic block:
- and:
- offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew
@ -43,7 +45,12 @@ rule:
- offset: 0x14 = IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader
- offset: 0x16 = IMAGE_NT_HEADERS.FileHeader.Characteristics
- offset: 0x28 = IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint # for 32 and 64 bit
- offset/x32: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase
- offset/x32: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage
- offset/x64: 0x30 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase
- offset/x64: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage
- or:
- and:
- arch: i386
- offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase
- offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage
- and:
- arch: amd64
- offset: 0x30 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase
- offset: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage

8
load-code/pe/rebuild-import-table.yml
View file

@ -25,7 +25,11 @@ rule:
- optional:
- description: import by ordinal
- or:
- number/x32: 0x80000000 = IMAGE_SNAP_BY_ORDINAL32
- number/x64: 0x8000000000000000 = IMAGE_SNAP_BY_ORDINAL64
- and:
- arch: i386
- number: 0x80000000 = IMAGE_SNAP_BY_ORDINAL32
- and:
- arch: amd64
- number: 0x8000000000000000 = IMAGE_SNAP_BY_ORDINAL64
- number: 0xFFFF = IMAGE_ORDINAL
- number: 0x2 = thunk->u1.AddressOfData

7
load-code/shellcode/execute-shellcode-via-copyfile2.yml
View file

@ -20,8 +20,11 @@ rule:
# lea r9d, [rcx+40h] ; flProtect
# call cs:VirtualAlloc
- match: allocate memory
- mnemonic: lea
- offset: 0x40
- or:
- number: 0x40
- instruction:
- mnemonic: lea
- offset: 0x40
- api: CopyFile2
- api: DeleteFileW
- number: 0x00000001 = COPY_FILE_FAIL_IF_EXISTS