avast / avast/retdec-idaplugin

Improve output quality of real malware samples

Open
#16 2 comments 0 reactions 0 assignees View on GitHub
enhancement P-output
Dominant language
C++
Stars
799
Forks
132
PR merge metrics
No merged PRs in 30d

Description

Investigate problems in these samples. solve them, and add regression tests: [samples.zip](https://github.com/avast-tl/retdec-idaplugin/files/1674405/samples.zip)(MALWARE!).

`89442e72227b209b7fcbe467a6b202c1788b850bdfbb52fa22c7762a45b1737c`
- Strings in function calls:
```c
OutputDebugStringW(L"It was a joke about heroin, but now im going to sell heroin to your mother :P");
CreateMutexW(0, 0, L"Local\\Fabiansomware");
StrStrW(&ExistingFileName, L"winlogon.exe");
```
- Overall quality.

`20AE07CC27965D330314776C16E8FAA3FA021AB7E4C6FFC86A3593AC4010BDFE.dat`:
- Empty functions bodies: `WinMain, sub_4018E0, sub_401870`, etc.
- Overall quality.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the two sample hashes and samples.zip, then reproduce the reported string-in-function-call and empty-function-body output in the plugin. Compare the generated analysis with the listed expectations and identify the relevant regression-test location; done means the samples no longer show those defects and regression tests cover them.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.