mirror of
https://github.com/vee1e/capa-rules.git
synced 2026-09-03 20:07:18 +00:00
1fd0d8e141
* Add SysWhisper2 detection & add int 2e to syscall detection --------- Signed-off-by: Still Hsu <dev@stillu.cc> Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
34 lines
938 B
YAML
34 lines
938 B
YAML
rule:
|
|
meta:
|
|
name: execute syscall
|
|
namespace: anti-analysis
|
|
authors:
|
|
- "@kulinacs"
|
|
- "@mr-tz"
|
|
- mehunhoff@google.com
|
|
- still@teamt5.org
|
|
description: may be used to evade hooks or hinder analysis
|
|
scopes:
|
|
static: basic block
|
|
dynamic: unsupported # requires mnemonic features
|
|
references:
|
|
- https://github.com/j00ru/windows-syscalls
|
|
- https://codemachine.com/articles/system_call_instructions.html
|
|
- https://www.felixcloutier.com/x86/sysenter
|
|
features:
|
|
- or:
|
|
- and:
|
|
- or:
|
|
- os: linux
|
|
- os: android
|
|
- api: syscall # https://man7.org/linux/man-pages/man2/syscall.2.html
|
|
- and:
|
|
- or:
|
|
- mnemonic: sysenter
|
|
- mnemonic: syscall
|
|
- instruction:
|
|
- mnemonic: int
|
|
- operand[0].number: 0x2e
|
|
- or:
|
|
- mnemonic: ret
|
|
- mnemonic: retn
|