google / google/vxsig

VxSig doesn't seem to be producing correct Yara signatures when using static binaries

Open
#13 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
288
Forks
34
PR merge metrics
No merged PRs in 30d

Description

The Yara signatures look off, and don't correctly match the expected binaries when using static binaries, produced using Ida Free, BinExport, and processed via VxSig.

Processing the following files outputs the warnings:
string "$" may slow down scanning
warning: rule "VxSig_Signature": too many matches for $, results for this rule may be incorrect
warning: rule "VxSig_Signature": too many matches for $, results for this rule may be incorrect
warning: rule "VxSig_Signature": too many matches for $, results for this rule may be incorrect
warning: rule "VxSig_Signature": too many matches for $, results for this rule may be incorrect
warning: rule "VxSig_Signature": too many matches for $, results for this rule may be incorrect

And only one of the two files used to produce the diff is matched by the signatures.

Files attached:
[vxsig_attempt.zip](https://github.com/google/vxsig/files/14316861/vxsig_attempt.zip)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.