avast / avast/retdec

Let users supply their own tools signature files

Open
#225 0 comments 0 reactions 0 assignees View on GitHub
C-support enhancement new-feature
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

Related to #220. Solve this only after #220.

Related to #221, #222, #223, #224, #225. Solve them together or close one after another. Share design decisions - uniform solutions.

Let users supply their own tools (compilers, packers, installers) signature files.

Right now, RetDec tools use only signatures from `support/yara_patterns/tools` to identify known tools.

Probably refactor the whole system in the process:
- Refactor the directory structure. Something like share/retdec/support/tools-patterns/.
- Let users specify their own pattern file(s) or whole directory(s) through `retdec-decompiler.sh` script parameter. Specified files can be both text YARA and compiled YARA rules.
- Let users add their files to the user support directory (e.g. something like share/retdec/user-support/tools-patterns). These will be always used, without user needing to specify them via script parameters.
- Write a how-to wiki page. Encourage users to contribute their signatures to upstream.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reading #220 and the related issues #221-#224, since this issue requires shared design decisions. Inspect support/yara_patterns/tools and retdec-decompiler.sh, then define the directory and parameter changes described here. Done means user-supplied text or compiled signatures, user-support patterns, and a how-to wiki page are supported together.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, shell
Domain
documentation, reverse-engineering, tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.