Feature request: loop scope
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 6.2k
- Forks
- 726
- Avg merge
- 11d 11h
- Merged PRs (30d)
- 7
Description
Introducing a new `loop` scope could be useful in some rules. For example:
```
rule:
meta:
name: enumerate PE sections
namespace: load-code/pe
author: "@Ana06"
scope: function
references:
- https://0x00sec.org/t/reflective-dll-injection/3080
- https://www.ired.team/offensive-security/code-injection-process-injection/reflective-dll-injection
examples:
- E4C33AC3638EEF68311F8AC0D72483C7:0x401510
features:
- and:
- offset: 0x6 = IMAGE_NT_HEADERS.FileHeader.NumberOfSections
- basic block:
- or:
- and:
- description: IMAGE_FIRST_SECTION(nt_header)
- offset: 0x14 = IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader
- offset: 0x18 = FileHeader.SizeOfOptionalHeader
- and:
- description: (DWORD)dll_raw + dos_header->e_lfanew + sizeof(IMAGE_NT_HEADERS) + sizeof(IMAGE_SECTION_HEADER) * i
- number: 0x28 = sizeof(IMAGE_SECTION_HEADER)
- or:
- offset/x32: 0xF8 = sizeof(IMAGE_NT_HEADERS32)
- offset/x64: 0x108 = sizeof(IMAGE_NT_HEADERS64)
- loop:
- and:
- offset: 0xC = IMAGE_SECTION_HEADER.VirtualAddress
- offset: 0x14 = IMAGE_SECTION_HEADER.PointerToRawData
- offset: 0x10 = IMAGE_SECTION_HEADER.SizeOfRawData
```
From https://github.com/fireeye/capa-rules/pull/308#discussion_r600715392
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the proposed rule example and the referenced capa-rules pull request discussion. No implementation files or tests are named in the issue; done would mean defining and supporting a new loop scope for rules like the PE-section example.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- reverse-engineering, tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100