Mohammed Abuhassan f061a7d846 rules(x64): add targeted byte packs (Sliver, Havoc, Meterpreter, UPX) ...

Four new raw-byte rule packs that target signature atoms from
high-profile public offensive tooling. Each pack is sourced from
public upstream repos and is limited to short fixed byte windows
that ship inside the stager / loader code paths, so the patches
are safe to apply with the existing raw-pair matcher:

sliver.yaml              - Sliver implant stager byte pairs
havoc.yaml               - Havoc demon byte pairs
meterpreter_stager.yaml  - Metasploit reverse_tcp stager byte pairs
upx_stub.yaml            - UPX packer-stub byte pairs (Defender's
                           generic-packer atom)

The integration test table in targeted_byte_pairs_test.cpp grows
one entry per pack, asserting each one loads, queues into the
applied-patch list, and round-trips through Patcher::apply ->
Patcher::rollback with identical post-rollback bytes.

These packs strictly add coverage; no existing rule, encoder, or
matcher path is touched.

2026-06-06 13:52:19 +03:00

..

x64

rules(x64): add targeted byte packs (Sliver, Havoc, Meterpreter, UPX)

2026-06-06 13:52:19 +03:00

yara

chore: anchor VS build-dir ignores so rule packs ship with the repo

2026-06-06 13:52:19 +03:00