mirror of
https://github.com/mandiant/capa-rules
synced 2026-06-08 15:41:20 +00:00
update description
This commit is contained in:
@@ -15,8 +15,10 @@ rule:
|
||||
# The constant words spell "expand 32-byte k" in ASCII (i.e. the 4 words are "expa", "nd 3", "2-by", and "te k")
|
||||
- or:
|
||||
- description: part of key setup
|
||||
- string: "expand 32-byte k" = sigma
|
||||
- string: "expand 16-byte k" = tau
|
||||
- string: "expand 32-byte k"
|
||||
description: sigma
|
||||
- string: "expand 16-byte k"
|
||||
description: tau
|
||||
# if sigma and tau are in contiguous memory, may result in concatenated string
|
||||
- string: "expand 32-byte kexpand 16-byte k"
|
||||
- and:
|
||||
|
||||
Reference in New Issue
Block a user