update linux/android rules and reduce fps for intel-specific rules (#927

) * android: add / update rules * intel: match intel archs to avoid fps on others
mandiant · Aug 16, 2024 · 5b8c8a6 · 5b8c8a6
1 parent 10ca24c
commit 5b8c8a6
Show file tree

Hide file tree

Showing 3 changed files with 25 additions and 0 deletions.
diff --git a/host-interaction/log/debug/write-event/print-debug-messages.yml b/host-interaction/log/debug/write-event/print-debug-messages.yml
@@ -13,3 +13,6 @@ rule:
  - or:
  - api: DbgPrint
  - api: kernel32.OutputDebugString
+ - and:
+ - os: android
+ - api: __android_log_print
diff --git a/lib/calculate-modulo-256-via-x86-assembly.yml b/lib/calculate-modulo-256-via-x86-assembly.yml
@@ -15,6 +15,9 @@ rule:
  # and ecx, 800000FFh
  # and ecx, 0FFh
  - and:
+ - or:
+ - arch: i386
+ - arch: amd64
  - mnemonic: and
  - or:
  - number: 0x800000FF

diff --git a/nursery/delete-file-on-linux.yml b/nursery/delete-file-on-linux.yml
@@ -0,0 +1,19 @@
+rule:
+ meta:
+ name: delete file on Linux
+ namespace: host-interaction/file-system/delete
+ authors:
+ - mehunhoff@google.com
+ scopes:
+ static: basic block
+ dynamic: call
+ mbc:
+ - File System::Delete File [C0047]
+ features:
+ - and:
+ - or:
+ - os: linux
+ - os: android
+ - or:
+ - api: unlink
+ - api: unlinkat