adding new and updating linux / android rules (#903)

* adding new and updating linux / android rules

* fix lints

host-interaction/file-system/change-file-permission-on-linux.yml

@@ -4,6 +4,7 @@ rule:
     namespace: host-interaction/file-system
     authors:
       - joakim@intezer.com
+      - mehunhoff@google.com
     scopes:
       static: basic block
       dynamic: call
@@ -13,9 +14,14 @@ rule:
       - 7351f8a40c5450557b24622417fc478d:0x407C68
   features:
     - and:
-      - os: linux
+      - or:
+        - os: android
+        - os: linux
       - or:
         - api: chown
         - api: fchown
         - api: lchown
         - api: fchownat
+        - api: chmod
+        - api: fchmod
+        - api: fchmodat

host-interaction/process/create/create-process-on-linux.yml

@@ -4,6 +4,7 @@ rule:
     namespace: host-interaction/process/create
     authors:
       - joakim@intezer.com
+      - mehunhoff@google.com
     scopes:
       static: basic block
       dynamic: call
@@ -27,3 +28,4 @@ rule:
         - api: posix_spawn
         - api: posix_spawnp
         - api: popen
+        - api: fork

nursery/change-memory-permission-on-linux.yml

@@ -0,0 +1,17 @@
+rule:
+  meta:
+    name: change memory permission on Linux
+    namespace: host-interaction/memory
+    authors:
+      - mehunhoff@google.com
+    scopes:
+      static: function
+      dynamic: call
+  features:
+    - and:
+      - or:
+        - os: linux
+        - os: android
+      - or:
+        - api: mprotect
+        - api: pkey_mprotect

nursery/check-file-permission-on-linux.yml

@@ -0,0 +1,17 @@
+rule:
+  meta:
+    name: check file permission on Linux
+    namespace: host-interaction/file-system
+    authors:
+      - mehunhoff@google.com
+    scopes:
+      static: function
+      dynamic: call
+  features:
+    - and:
+      - or:
+        - os: android
+        - os: linux
+      - or:
+        - api: access
+        - api: faccessat

nursery/check-if-process-is-running-under-android-emulator-on-android.yml

@@ -0,0 +1,19 @@
+rule:
+  meta:
+    name: check if process is running under Android emulator on Android
+    namespace: anti-analysis/anti-emulation/android
+    authors:
+      - mehunhoff@google.com
+    scopes:
+      static: function
+      dynamic: call
+    references:
+      - https://github.com/happylishang/AntiFakerAndroidChecker/blob/master/antifake/src/main/jni/emulator/emcheck64.c
+  features:
+    - and:
+      - or:
+        - os: linux
+        - os: android
+      - string: "com/snail/antifake/jni/EmulatorDetectUtil"
+      - optional:
+        - string: "getSystemArch"

nursery/map-or-unmap-memory-on-linux.yml

@@ -0,0 +1,17 @@
+rule:
+  meta:
+    name: map or unmap memory on Linux
+    namespace: host-interaction/memory
+    authors:
+      - mehunhoff@google.com
+    scopes:
+      static: function
+      dynamic: call
+  features:
+    - and:
+      - or:
+        - os: linux
+        - os: android
+      - or:
+        - api: mmap
+        - api: munmap