Extract CFG dispatcher function names
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 6.2k
- Forks
- 726
- Avg merge
- 11d 11h
- Merged PRs (30d)
- 7
Description
### Summary
Extract dispatcher function names from CFG header so it can be used in CAPA rules.
Maybe the function name can be recovered here:
https://github.com/williballenthin/lancelot/blob/487d2e35766819a597b04a9439bf3b5d4571d4d1/core/src/analysis/pe/control_flow_guard.rs#L16
Example pseudo rule:
VirtualProtect RWX
_guard_dispatch_icall_fptr
VirtualProtect (Restore old permission)
Example, Basic block/function scope
api(VirtualProtect)
api(_guard_dispatch_icall_nop)
api(VirtualProtect)
Example MD5 and addr:
74bc2d0b6680faa1a5a76b27e5479cbc:0x18004DE60
### Motivation
Be able to create CAPA rules on files leveraging CFG dispatcher functions to indirect call shellcode.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the linked lancelot file, core/src/analysis/pe/control_flow_guard.rs, to understand how CFG dispatcher names are recovered. Then locate the corresponding CAPA extraction path and determine how those names should become available to rules; done means the example dispatcher functions can be identified from supported files and used in CAPA rules.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python, rust
- Domain
- reverse-engineering
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 38/100