* Initial additions for detecting donut features
Signed-off-by: Still Hsu <dev@stillu.cc>
* Lint rules
Signed-off-by: Still Hsu <dev@stillu.cc>
* Update ATT&CK for donut rule
Signed-off-by: Still Hsu <dev@stillu.cc>
* Fix comment for dynamic scope on donut loader
Signed-off-by: Still Hsu <dev@stillu.cc>
* Require at least one donut function match for donut rule
Signed-off-by: Still Hsu <dev@stillu.cc>
* Add offset for examples
Signed-off-by: Still Hsu <dev@stillu.cc>
* Add indirect call for IAssembly matching
Signed-off-by: Still Hsu <dev@stillu.cc>
* Match known vtable offsets for assembly loading
* Remove loop matching
---------
Signed-off-by: Still Hsu <dev@stillu.cc>
* Add use-bigint-function
Add new `data-manipulation/encryption/use-bigint-function.yml` rule to
identify bigint functions as these functions may help reverse engineers
identifying crypto. Example of bigint functions identified by this rule:
- `bi_copi`
- `bi_permanent`
- `bi_depermant`
- `bi_free`
Reference:
- 147d69429b/src/bigint.c
- 3e9b57d82a/src/crypto/bigint.c
* Add rsa-encrypt
Add new rule `data-manipulation/encryption/rsa/rsa-encrypt.yml` that
identifies the RSA encryption implementation from:
- 147d69429b/src/rsa.c (L232)
- 3e9b57d82a/src/crypto/rsa.c (L233)
Rename current RSA encryption/decryption rules in the nursery to add
`via WinAPI` to prevent name conflict.
* Create encrypt-data-using-rc4-via-systemfunction033.yml
Similar to SystemFunction032, this undocumented API allows encryption/decryption using RC4 algo
* Adding rules for TEA, XTEA, XXTEA and RIPEMD hashing
Adding to current rules for TEA encrypt & decrypt
Adding rules for XTEA, XXTEA, RIPEMD-128, 160, 256, 320
* Description edited for clarity
* byte pattern correction
* updates
- rules with examples moved out of nursery
- unneeded examples removed from rules and their example files removed from the PR for capa-testfiles
- DS_store files deleted
- Descriptions edited to reflect shared magic constants with SHA1
* ripemd128 update
updated to include magic array not present in MD5
* MD5 & SHA1 documentation update + RIPEMD160 removal
Updating MD5 & SHA1 rules to document magic constants shared with other hashing routines.
Removing RIPEMD160 rule using magic constants due to likelihood of false positives with SHA1 routines
* ripemd320 description update
