avast / avast/retdec-idaplugin
Improve output quality of real malware samples
- Dominant language
- C++
- Stars
- 799
- Forks
- 132
- PR merge metrics
- No merged PRs in 30d
Description
Investigate problems in these samples. solve them, and add regression tests: [samples.zip](https://github.com/avast-tl/retdec-idaplugin/files/1674405/samples.zip)(MALWARE!).
`89442e72227b209b7fcbe467a6b202c1788b850bdfbb52fa22c7762a45b1737c`
- Strings in function calls:
```c
OutputDebugStringW(L"It was a joke about heroin, but now im going to sell heroin to your mother :P");
CreateMutexW(0, 0, L"Local\\Fabiansomware");
StrStrW(&ExistingFileName, L"winlogon.exe");
```
- Overall quality.
`20AE07CC27965D330314776C16E8FAA3FA021AB7E4C6FFC86A3593AC4010BDFE.dat`:
- Empty functions bodies: `WinMain, sub_4018E0, sub_401870`, etc.
- Overall quality.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the two sample hashes and samples.zip, then reproduce the reported string-in-function-call and empty-function-body output in the plugin. Compare the generated analysis with the listed expectations and identify the relevant regression-test location; done means the samples no longer show those defects and regression tests cover them.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100