vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 10:58:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

specify offset operand to reduce FPs (#716)

Browse source 
* specify offset operand to reduce FPs

* add instruction specifics
This commit is contained in:
Moritz 2023-03-01 16:08:17 +01:00 • committed by GitHub
parent 1bc2fe6a7d
commit f81d04729a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 39 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

32
load-code/pe/enumerate-pe-sections.yml
View file

@ -15,25 +15,41 @@ rule:
features:
- and:
- os: windows
- offset: 0x6 = IMAGE_NT_HEADERS.FileHeader.NumberOfSections
# there should be some complexity to functions like this
- count(basic blocks): 3 or more
- optional:
- offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew
- instruction:
- or:
- mnemonic: mov
- mnemonic: movzx
- operand[1].offset: 0x6 = IMAGE_NT_HEADERS.FileHeader.NumberOfSections
- basic block:
- or:
- and:
- description: IMAGE_FIRST_SECTION(nt_header)
- offset: 0x14 = IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader
- offset: 0x18 = FileHeader.SizeOfOptionalHeader
- instruction:
- or:
- mnemonic: add
- mnemonic: mov
- mnemonic: movzx
- operand[1].offset: 0x14 = IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader
- operand[1].offset: 0x18 = FileHeader.SizeOfOptionalHeader
- and:
- description: (DWORD)dll_raw + dos_header->e_lfanew + sizeof(IMAGE_NT_HEADERS) + sizeof(IMAGE_SECTION_HEADER) * i
- number: 0x28 = sizeof(IMAGE_SECTION_HEADER)
- or:
- and:
- arch: i386
- offset: 0xF8 = sizeof(IMAGE_NT_HEADERS32)
- operand[1].offset: 0xF8 = sizeof(IMAGE_NT_HEADERS32)
- and:
- arch: amd64
- offset: 0x108 = sizeof(IMAGE_NT_HEADERS64)
- operand[1].offset: 0x108 = sizeof(IMAGE_NT_HEADERS64)
- basic block:
- and:
- offset: 0xC = IMAGE_SECTION_HEADER.VirtualAddress
- offset: 0x14 = IMAGE_SECTION_HEADER.PointerToRawData
- offset: 0x10 = IMAGE_SECTION_HEADER.SizeOfRawData
- operand[1].offset: 0xC = IMAGE_SECTION_HEADER.VirtualAddress
- operand[1].offset: 0x14 = IMAGE_SECTION_HEADER.PointerToRawData
- operand[1].offset: 0x10 = IMAGE_SECTION_HEADER.SizeOfRawData
- not:
# non-zeroing XOR was observed in FPs
- characteristic: nzxor

31
load-code/pe/parse-pe-header.yml
View file

@ -10,7 +10,6 @@ rule:
examples:
- 9324D1A8AE37A36AE560C37448C9705A:0x403DD0
features:
# TODO filter out false positives
- and:
- os: windows
- and:
@ -27,31 +26,31 @@ rule:
- number: 0x5A
- optional:
- and:
- offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew
- operand[1].offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew
- or:
- and:
- arch: i386
- offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage
- offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase
- operand[1].offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage
- operand[1].offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase
- and:
- arch: amd64
- offset: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage
- offset: 0x30 = IMAGE_NT_HEADERS64.OptionalHeader.ImageBase
- operand[1].offset: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage
- operand[1].offset: 0x30 = IMAGE_NT_HEADERS64.OptionalHeader.ImageBase
- basic block:
- and:
- offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew
- operand[1].offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew
- 3 or more:
- offset: 0x4 = IMAGE_NT_HEADERS.FileHeader.Machine
- offset: 0x6 = IMAGE_NT_HEADERS.FileHeader.NumberOfSections
- offset: 0x14 = IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader
- offset: 0x16 = IMAGE_NT_HEADERS.FileHeader.Characteristics
- offset: 0x28 = IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint # for 32 and 64 bit
- operand[1].offset: 0x4 = IMAGE_NT_HEADERS.FileHeader.Machine
- operand[1].offset: 0x6 = IMAGE_NT_HEADERS.FileHeader.NumberOfSections
- operand[1].offset: 0x14 = IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader
- operand[1].offset: 0x16 = IMAGE_NT_HEADERS.FileHeader.Characteristics
- operand[1].offset: 0x28 = IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint # for 32 and 64 bit
- or:
- and:
- arch: i386
- offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase
- offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage
- operand[1].offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase
- operand[1].offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage
- and:
- arch: amd64
- offset: 0x30 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase
- offset: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage
- operand[1].offset: 0x30 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase
- operand[1].offset: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage