VxSig doesn't seem to be producing correct Yara signatures when using static binaries
- Dominant language
- C++
- Stars
- 288
- Forks
- 34
- PR merge metrics
- No merged PRs in 30d
Description
The Yara signatures look off, and don't correctly match the expected binaries when using static binaries, produced using Ida Free, BinExport, and processed via VxSig.
Processing the following files outputs the warnings:
string "$" may slow down scanning
warning: rule "VxSig_Signature": too many matches for $, results for this rule may be incorrect
warning: rule "VxSig_Signature": too many matches for $, results for this rule may be incorrect
warning: rule "VxSig_Signature": too many matches for $, results for this rule may be incorrect
warning: rule "VxSig_Signature": too many matches for $, results for this rule may be incorrect
warning: rule "VxSig_Signature": too many matches for $, results for this rule may be incorrect
And only one of the two files used to produce the diff is matched by the signatures.
Files attached:
[vxsig_attempt.zip](https://github.com/google/vxsig/files/14316861/vxsig_attempt.zip)
Contributor guide
Assessment
This issue has not been assessed yet.