admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add files via upload

Browse Source
This commit is contained in:
re-fox
2020-08-10 12:13:39 -04:00
committed by GitHub
parent 1acb8803c2
commit 39b0128967
2 changed files with 135 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/validate-credit-card-number-using-luhn-algorithm-with-lookup-table.yml
+68
View File
@@ -0,0 +1,68 @@
rule:
meta:
name: validate credit card number using luhn algorithm with lookup table
lib: true
author: "@_re_fox"
scope: function
examples:
- 1d8fd13c890060464019c0f07b928b1a:0x401920
- 60abaef3fda131ffa20df480cb3f8029:0x4048e0
features:
- and:
- not:
- characteristic: nzxor
- characteristic: loop
description: Iterate over CC digits
- basic block:
- or:
- 8 or more:
- number: 0x0
- number: 0x2
- number: 0x4
- number: 0x6
- number: 0x8
- number: 0x1
- number: 0x3
- number: 0x5
- number: 0x7
- number: 0x9
description: Digital root lookup table
- 8 or more:
- number: 0x0
- number: 0x1
- number: 0x2
- number: 0x3
- number: 0x4
- number: 0xfffffffc
- number: 0xfffffffd
- number: 0xfffffffe
- number: 0xffffffff
description: Digital root lookup table via neg numbers
- basic block:
- or:
- and:
- number: 0x30
- mnemonic: sub
description: Conversion of chr to int (SUB 0x30)
- and:
- mnemonic: lea
- offset: -0x30
description: Conversion of chr to int (LEA REG,[REG+ -0x30])
- basic block:
- or:
- and:
- mnemonic: idiv
- mnemonic: cdq
- number: 0xa
- optional :
- mnemonic: neg
description: Final section returning checkum % 10
- and:
- mnemonic: shr
- mnemonic: imul
- number: 0x66666667
- number: 0x1f
- number: 0x2
- optional :
- mnemonic: neg
description: Compiler optimized returning checkum % 10
lib/validate-credit-card-number-using-luhn-algorithm-with-no-lookup-table.yml
+67
View File
@@ -0,0 +1,67 @@
rule:
meta:
name: validate credit card number using luhn algorithm with no lookup table
lib: true
author: "@_re_fox"
scope: function
examples:
- 6fcc13563aad936c7d0f3165351cb453:0x4026C0
features:
- and:
- not:
- characteristic: nzxor
- characteristic: loop
description: Iterate over CC digits
- or:
- basic block:
- and:
- or:
- and:
- mnemonic: add
- and:
- mnemonic: shl
- number: 0x1
- mnemonic: cmp
- number: 0x9
description: Digital Root check number*2 < 0x9
- and:
- basic block:
- and:
- mnemonic: cmp
- number: 0x9
description: Compare number to 0x9 for Digital Root
- basic block:
- or:
- mnemonic: add
- and:
- mnemonic: shl
- number: 0x1
description: 2*Number for Digital Root
- basic block:
- or:
- and:
- number: 0x30
- mnemonic: sub
description: Conversion of chr to int (SUB 0x30)
- and:
- mnemonic: lea
- offset: -0x30
description: Conversion of chr to int (LEA REG,[REG+ -0x30])
- basic block:
- or:
- and:
- mnemonic: idiv
- mnemonic: cdq
- number: 0xa
- optional :
- mnemonic: neg
description: Final section returning checkum % 10
- and:
- mnemonic: shr
- mnemonic: imul
- number: 0x66666667
- number: 0x1f
- number: 0x2
- optional :
- mnemonic: neg
description: Compiler optimized returning checkum % 10