From 433b32c1b003efe78ee38d8e7c8b795fa1fe2c76 Mon Sep 17 00:00:00 2001
From: Moritz Raabe <moritz.raabe@fireeye.com>
Date: Tue, 11 Aug 2020 16:07:08 +0200
Subject: [PATCH] improve RC4 rules closes #91

---
 .../encryption/rc4/encrypt-data-using-rc4-ksa.yml        | 9 ++++++++-
 .../encryption/rc4/encrypt-data-using-rc4-prga.yml       | 8 ++++++--
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml
index e04e2350..218f5c86 100644
--- a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml
+++ b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml
@@ -11,6 +11,7 @@ rule:
       - C805528F6844D7CAF5793C025B56F67D:0x4067AE
       - 9324D1A8AE37A36AE560C37448C9705A:0x404950
       - 782A48821D88060ADF0F7EF3E8759FEE3DDAD49E942DAAD18C5AF8AE0E9EB51E:0x405C42
+      - 73CE04892E5F39EC82B00C02FC04C70F:0x40646E
   features:
     - or:
       - and:
@@ -22,10 +23,16 @@ rule:
             - or:
               - number: 0xFF
               - number: 0x100
-        - match: calculate modulo 256 via x86 assembly
+          description: initialize S
+        - or:
+          - match: calculate modulo 256 via x86 assembly
+          # compiler may do this via zero-extended mov from 8-bit register
+          - count(mnemonic(movzx)): 2 or more
+          description: modulo 256
         - or:
           - mnemonic: div
           - mnemonic: idiv
+          description: modulo key length
       # optimized, writes DWORDs instead of bytes
       - and:
         - or:
diff --git a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml
index 6a91fcc8..a0550763 100644
--- a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml
+++ b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml
@@ -10,12 +10,16 @@ rule:
       - 34404A3FB9804977C6AB86CB991FB130:0x403DB0
       - 34404A3FB9804977C6AB86CB991FB130:0x403E50
       - 9324D1A8AE37A36AE560C37448C9705A:0x4049F0
+      - 73CE04892E5F39EC82B00C02FC04C70F:0x4064C6
   features:
     - and:
       # TODO: maybe add characteristic for nzxor reg size
       - count(characteristic(nzxor)): 1
-      # TODO optimized code uses an 8-bit register for this, e.g. BL at 782a48821d88060adf0f7ef3e8759fee3ddad49e942daad18c5af8ae0e9eb51e:0x405CC1
-      - match: calculate modulo 256 via x86 assembly
+      - or:
+        - match: calculate modulo 256 via x86 assembly
+        # compiler may do this via zero-extended mov from 8-bit register
+        - count(mnemonic(movzx)): 4 or more
+        description: modulo 256
       # should not call (many) functions
       - count(characteristic(calls from)): (0, 4)
       # should not be too simple