From 33ae14eb539dd2cdc827222e2eaeb376de21399e Mon Sep 17 00:00:00 2001 From: Moritz Raabe Date: Wed, 30 Sep 2020 17:48:02 +0200 Subject: [PATCH] use new description syntax --- .../check-for-trap-flag-exception.yml | 4 ++-- .../compression/decompress-data-using-quicklz.yml | 6 +++--- .../encryption/des/encrypt-data-using-des.yml | 2 +- .../encryption/rc4/encrypt-data-using-rc4-ksa.yml | 7 +++---- .../encryption/rc4/encrypt-data-using-rc4-prga.yml | 1 - .../hashing/murmur/hash-data-using-murmur3.yml | 6 +++--- .../hashing/tiger/hash-data-using-tiger.yml | 2 +- ...mber-using-luhn-algorithm-with-lookup-table.yml | 12 ++++++------ ...r-using-luhn-algorithm-with-no-lookup-table.yml | 14 +++++++------- nursery/empty-recycle-bin-quietly.yml | 2 +- 10 files changed, 27 insertions(+), 29 deletions(-) diff --git a/anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml b/anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml index e881a1ed..77d2506d 100644 --- a/anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml +++ b/anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml @@ -14,6 +14,7 @@ rule: features: - and: - or: + - description: read/write EFLAGS register - and: - mnemonic: pushf - mnemonic: popf @@ -23,12 +24,11 @@ rule: - and: - mnemonic: pushfq - mnemonic: popfq - # description: read/write EFLAGS register - or: + - description: set trap flag - and: - mnemonic: or - number: 0x100 - and: - mnemonic: bts - number: 0x8 - # description: set trap flag diff --git a/data-manipulation/compression/decompress-data-using-quicklz.yml b/data-manipulation/compression/decompress-data-using-quicklz.yml index d3003d47..9a554d5d 100644 --- a/data-manipulation/compression/decompress-data-using-quicklz.yml +++ b/data-manipulation/compression/decompress-data-using-quicklz.yml @@ -19,6 +19,7 @@ rule: - or: - basic block: - and: + - description: Mode 1 decompression - mnemonic: xor - mnemonic: shr - mnemonic: and @@ -27,17 +28,17 @@ rule: - or: - offset: 0x4000 - offset: 0x8000 - # description: Mode 1 decompression - basic block: - and: + - description: Mode 2 decompression - mnemonic: shr - mnemonic: and - mnemonic: mov - number: 0x5 - number: 0x1 - number: 0x7FF - # description: Mode 2 decompression - and: + - description: Mode 3 decompression - basic block: - and: - mnemonic: shr @@ -51,4 +52,3 @@ rule: - mnemonic: shr - mnemonic: and - number: 0x3FF - # description: Mode 3 decompression \ No newline at end of file diff --git a/data-manipulation/encryption/des/encrypt-data-using-des.yml b/data-manipulation/encryption/des/encrypt-data-using-des.yml index 4d2813e5..f34ec1c7 100644 --- a/data-manipulation/encryption/des/encrypt-data-using-des.yml +++ b/data-manipulation/encryption/des/encrypt-data-using-des.yml @@ -23,6 +23,7 @@ rule: - bytes: 20 01 02 03 04 05 04 05 06 07 08 09 08 09 0a 0b 0c 0d 0c 0d 0e 0f 10 11 10 11 12 13 14 15 14 15 16 17 18 19 18 19 1a 1b 1c 1d 1c 1d 1e 1f 20 01 = DES Expansion - bytes: 10 07 14 15 1d 0c 1c 11 01 0f 17 1a 05 12 1f 0a 02 08 18 0e 20 1b 03 09 13 0d 1e 06 16 0b 04 19 = PBOX - and: + - description: DES RawProcessBlock - number: 0x18 - number: 0x10 - number: 0x8 @@ -30,4 +31,3 @@ rule: - characteristic: nzxor - count(mnemonic(shr)): 8 or more - mnemonic: ror - # description: DES RawProcessBlock diff --git a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml index 53fa45c6..08544706 100644 --- a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml +++ b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml @@ -17,24 +17,23 @@ rule: - and: - basic block: - and: + - description: initialize S # misses if regular loop is used, # however we cannot model that a loop contains a certain number - characteristic: tight loop - or: - number: 0xFF - number: 0x100 - # description: initialize S - or: - match: calculate modulo 256 via x86 assembly # compiler may do this via zero-extended mov from 8-bit register - count(mnemonic(movzx)): 2 or more - # description: modulo 256 - or: + - description: modulo key length - mnemonic: div - mnemonic: idiv - # description: modulo key length - # optimized, writes DWORDs instead of bytes - and: + - description: optimized, writes DWORDs instead of bytes - or: - number: 0xFFFEFDFC - mnemonic: sub diff --git a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml index 7c1effc2..c8504523 100644 --- a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml +++ b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml @@ -19,7 +19,6 @@ rule: - match: calculate modulo 256 via x86 assembly # compiler may do this via zero-extended mov from 8-bit register - count(mnemonic(movzx)): 4 or more - # description: modulo 256 # should not call (many) functions - count(characteristic(calls from)): (0, 4) # should not be too simple diff --git a/data-manipulation/hashing/murmur/hash-data-using-murmur3.yml b/data-manipulation/hashing/murmur/hash-data-using-murmur3.yml index f4399c40..921b32d6 100644 --- a/data-manipulation/hashing/murmur/hash-data-using-murmur3.yml +++ b/data-manipulation/hashing/murmur/hash-data-using-murmur3.yml @@ -29,22 +29,22 @@ rule: - number: 0x4cf5ad432745937f = 64-bit c2 for 128-bit hash - basic block: - and: + - description: 'hash >> 16; hash >> 13; hash >> 16' - count(mnemonic(shr)): 3 - number: 16 - number: 13 - optional: - count(characteristic(nzxor)): 3 or more - # description: 'hash >> 16; hash >> 13; hash >> 16' - and: # Group this two blocks under an `and` as on their own they are not # unique enough and would cause false positives - basic block: - and: + - description: k ROL r1 - mnemonic: rol - number: 15 = r1 - # description: k ROL r1 - basic block: - and: + - description: hash ROL r2 - mnemonic: rol - number: 13 = r2 - # description: hash ROL r2 diff --git a/data-manipulation/hashing/tiger/hash-data-using-tiger.yml b/data-manipulation/hashing/tiger/hash-data-using-tiger.yml index 021d6d27..304b3dfb 100644 --- a/data-manipulation/hashing/tiger/hash-data-using-tiger.yml +++ b/data-manipulation/hashing/tiger/hash-data-using-tiger.yml @@ -14,6 +14,7 @@ rule: - bytes: 55 3c 32 26 85 60 0e 5b f5 59 1b fa a9 c1 46 1a fa 8f 4c 7c a1 45 e2 a9 d7 55 29 db 59 51 ca 65 c2 af 35 ce 76 0a db 05 45 3d 11 a9 7e c7 ea 81 0d 0a ac b6 8a f8 8e 52 ff e3 7b 59 53 a2 9e a0 56 cd 48 ac b3 df 0d 43 6f e4 5c f4 7a a6 b3 c4 5e d0 e2 fb d8 cf ce 4e f0 35 99 b3 10 6f f5 3e c6 19 d6 9c 82 d6 22 0b 69 20 df 74 0a 46 fd 17 40 ed 10 85 8e cc f8 6c a7 ca 6e 3a bf 24 c8 d6 49 70 81 1a 58 3d 24 61 a2 63 c1 bb b6 ac 8b 04 32 cc 44 7d c2 8a a3 d9 ab 10 f4 aa 5b ff dd 7f 4b 82 04 a8 5a 49 6d ad 94 9f 8c = sbox4 - or: - and: + - description: tiger key schedule - number: 0xa5a5a5a5a5a5a5a5 - number: 0x0123456789abcdef - number: 0x13 @@ -21,4 +22,3 @@ rule: - count(mnemonic(shr)) : 2 or more - count(mnemonic(shl)) : 2 or more - characteristic: nzxor - # description: tiger key schedule diff --git a/lib/validate-credit-card-number-using-luhn-algorithm-with-lookup-table.yml b/lib/validate-credit-card-number-using-luhn-algorithm-with-lookup-table.yml index b9ccff17..bba05355 100644 --- a/lib/validate-credit-card-number-using-luhn-algorithm-with-lookup-table.yml +++ b/lib/validate-credit-card-number-using-luhn-algorithm-with-lookup-table.yml @@ -16,6 +16,7 @@ rule: - basic block: - or: - 8 or more: + - description: Digital root lookup table - number: 0x0 - number: 0x2 - number: 0x4 @@ -26,8 +27,8 @@ rule: - number: 0x5 - number: 0x7 - number: 0x9 - # description: Digital root lookup table - 8 or more: + - description: Digital root lookup table via neg numbers - number: 0x0 - number: 0x1 - number: 0x2 @@ -37,27 +38,27 @@ rule: - number: 0xfffffffd - number: 0xfffffffe - number: 0xffffffff - # description: Digital root lookup table via neg numbers - basic block: - or: - and: + - description: Conversion of chr to int (SUB 0x30) - number: 0x30 - mnemonic: sub - # description: Conversion of chr to int (SUB 0x30) - and: + - description: Conversion of chr to int (LEA REG,[REG+ -0x30]) - mnemonic: lea - offset: -0x30 - # description: Conversion of chr to int (LEA REG,[REG+ -0x30]) - basic block: - or: - and: + - description: Final section returning checkum % 10 - mnemonic: idiv - mnemonic: cdq - number: 0xa - optional : - mnemonic: neg - # description: Final section returning checkum % 10 - and: + - description: Compiler optimized returning checkum % 10 - mnemonic: shr - mnemonic: imul - number: 0x66666667 @@ -65,4 +66,3 @@ rule: - number: 0x2 - optional : - mnemonic: neg - # description: Compiler optimized returning checkum % 10 diff --git a/lib/validate-credit-card-number-using-luhn-algorithm-with-no-lookup-table.yml b/lib/validate-credit-card-number-using-luhn-algorithm-with-no-lookup-table.yml index 5b643cd5..7fe68e03 100644 --- a/lib/validate-credit-card-number-using-luhn-algorithm-with-no-lookup-table.yml +++ b/lib/validate-credit-card-number-using-luhn-algorithm-with-no-lookup-table.yml @@ -23,30 +23,30 @@ rule: - number: 0x1 - mnemonic: cmp - number: 0x9 - # description: Digital Root check number*2 < 0x9 + - description: Digital Root check number*2 < 0x9 - and: - basic block: - and: - mnemonic: cmp - number: 0x9 - # description: Compare number to 0x9 for Digital Root + - description: Compare number to 0x9 for Digital Root - basic block: - or: - mnemonic: add - and: - mnemonic: shl - number: 0x1 - # description: 2*Number for Digital Root + - description: 2*Number for Digital Root - basic block: - or: - and: - number: 0x30 - mnemonic: sub - # description: Conversion of chr to int (SUB 0x30) + - description: Conversion of chr to int (SUB 0x30) - and: - mnemonic: lea - offset: -0x30 - # description: Conversion of chr to int (LEA REG,[REG+ -0x30]) + - description: Conversion of chr to int (LEA REG,[REG+ -0x30]) - basic block: - or: - and: @@ -55,7 +55,7 @@ rule: - number: 0xa - optional : - mnemonic: neg - # description: Final section returning checkum % 10 + - description: Final section returning checkum % 10 - and: - mnemonic: shr - mnemonic: imul @@ -64,4 +64,4 @@ rule: - number: 0x2 - optional : - mnemonic: neg - # description: Compiler optimized returning checkum % 10 + - description: Compiler optimized returning checkum % 10 diff --git a/nursery/empty-recycle-bin-quietly.yml b/nursery/empty-recycle-bin-quietly.yml index b7bee3e6..76b1bbae 100644 --- a/nursery/empty-recycle-bin-quietly.yml +++ b/nursery/empty-recycle-bin-quietly.yml @@ -15,5 +15,5 @@ rule: - and: - mnemonic: lea - offset: 7 = SHERB_NOSOUND|SHERB_NOPROGRESSUI|SHERB_NOCONFIRMATION - # description: accounts for argument loaded via LEA (lea r8d, [rdx+7]) + - description: accounts for argument loaded via LEA (lea r8d, [rdx+7]) - number: 7 = SHERB_NOSOUND|SHERB_NOPROGRESSUI|SHERB_NOCONFIRMATION