mandiant / mandiant/capa-rules
FP: BeingDebugged flag due to offset by register
Open
false negative
- Dominant language
- No language data
- Stars
- 736
- Forks
- 245
- Avg merge
- 4d 53m
- Merged PRs (30d)
- 2
Description
"check for BegingDebugged flag" wants `gs:[60h]` but this accesses via `gs:[eax]`
Contributor guide
Research direction
Locate the rule implementing the “check for BegingDebugged flag” behavior and inspect how it accesses gs:[60h] versus gs:[eax]. Confirm the intended offset and update the rule so its matching behavior reflects the reported access pattern; done when the corresponding check is recognized correctly.
Written by the indexing model from the issue text.
Assessment
- Domain
- reverse-engineering, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 45/100