Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

remove /x32 /x64 decorators from offset and number features #932

Closed
williballenthin opened this issue Mar 31, 2022 · 3 comments · Fixed by #961
Closed

remove /x32 /x64 decorators from offset and number features #932

williballenthin opened this issue Mar 31, 2022 · 3 comments · Fixed by #961
Assignees
Labels
breaking-change introduces a breaking change that should be released in a major version enhancement New feature or request
Milestone

Comments

@williballenthin
Copy link
Collaborator

williballenthin commented Mar 31, 2022

as discussed in #930, we have a better way to specify bitness logic (e.g. number/x32: ...) today:

- and:
  - arch: i386
  - offset: 0x10

while its a bit more verbose, its consistent with os, format, etc. features.

removing these flavors will reduce the amount of code we have to maintain (that threads bitness throughout feature sets).

it will also reduce the number of features we extract. for example, when considering mimikatz.exe, the vivisect backend extracts 322,647 total features, of which 49,206 (15%) are bitness flavored numbers and offsets.

@williballenthin
Copy link
Collaborator Author

this will be a breaking change

@williballenthin williballenthin added enhancement New feature or request breaking-change introduces a breaking change that should be released in a major version labels Mar 31, 2022
@williballenthin
Copy link
Collaborator Author

Here are the rules where we currently use these features:

rg "(offset|number)/x" -l
linking/runtime-linking/access-peb-ldr_data.yml
linking/runtime-linking/get-ntdll-base-address.yml
linking/runtime-linking/get-kernel32-base-address.yml
nursery/log-keystrokes-via-raw-input-data.yml
communication/socket/tcp/send/obtain-transmitpackets-callback-function-via-wsaioctl.yml
host-interaction/hardware/cpu/get-number-of-processors.yml
host-interaction/process/create/create-a-process-with-modified-io-handles-and-window.yml
host-interaction/process/get-process-heap-force-flags.yml
host-interaction/process/get-process-heap-flags.yml
lib/peb-access.yml
anti-analysis/anti-forensic/patch-process-command-line.yml
anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml
load-code/pe/enumerate-pe-sections.yml
load-code/pe/rebuild-import-table.yml
load-code/pe/parse-pe-header.yml

@williballenthin williballenthin added this to the 4.0.0 milestone Mar 31, 2022
@williballenthin
Copy link
Collaborator Author

during meeting, @mr-tz and @mike-hunhoff agreed that this should be removed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
breaking-change introduces a breaking change that should be released in a major version enhancement New feature or request
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant