update linux/android rules and reduce fps for intel-specific rules (#927

) * android: add / update rules * intel: match intel archs to avoid fps on others
mandiant · Aug 16, 2024 · 5b8c8a6 · 5b8c8a6
1 parent 10ca24c
commit 5b8c8a6
Show file tree

Hide file tree

Showing 3 changed files with 25 additions and 0 deletions.
diff --git a/host-interaction/log/debug/write-event/print-debug-messages.yml b/host-interaction/log/debug/write-event/print-debug-messages.yml
@@ -13,3 +13,6 @@ rule:
     - or:
       - api: DbgPrint
       - api: kernel32.OutputDebugString
+      - and:
+        - os: android
+        - api: __android_log_print
diff --git a/lib/calculate-modulo-256-via-x86-assembly.yml b/lib/calculate-modulo-256-via-x86-assembly.yml
@@ -15,6 +15,9 @@ rule:
     #  and ecx, 800000FFh
     #  and ecx, 0FFh
     - and:
+      - or:
+        - arch: i386
+        - arch: amd64
       - mnemonic: and
       - or:
         - number: 0x800000FF

diff --git a/nursery/delete-file-on-linux.yml b/nursery/delete-file-on-linux.yml
@@ -0,0 +1,19 @@
+rule:
+  meta:
+    name: delete file on Linux
+    namespace: host-interaction/file-system/delete
+    authors:
+      - mehunhoff@google.com
+    scopes:
+      static: basic block
+      dynamic: call
+    mbc:
+      - File System::Delete File [C0047]
+  features:
+    - and:
+      - or:
+        - os: linux
+        - os: android
+      - or:
+        - api: unlink
+        - api: unlinkat