mandiant / mandiant/capa-rules
open VM devices
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 736
- Forks
- 245
- Avg merge
- 4d 53m
- Merged PRs (30d)
- 2
Description
5e17360d32e9b272bb7e1b97c8e4dca34622ec9ce08fd240fe2758cc3f67dc4a:0x1400016FB
```yml
# generated using capa explorer for IDA Pro
rule:
meta:
name: access VM device
namespace: anti-analysis/anti-vm/vm-detection
authors:
- wballenthin@hex-rays.com
scopes:
static: basic block
dynamic: call
examples:
- 5e17360d32e9b272bb7e1b97c8e4dca34622ec9ce08fd240fe2758cc3f67dc4a:0x1400016FB
features:
- and:
- api: CreateFile
- or:
- string: "\\\\.\\VBoxGuest"
- string: "\\\\.\\VBoxTrayIPC"
- string: "\\\\.\\vmci"
- string: "\\\\.\\HGFS"
```
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing the supplied YAML rule with existing rules in the capa-rules repository, focusing on the CreateFile API and listed VM-device strings. Done means the rule is added in the repository's expected location and recognizes the supplied example address.
Written by the indexing model from the issue text.
Assessment
- Domain
- reverse-engineering, security
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100