malware-analysis

r_anal_esil_pushnum uses snprintf, sdb_itoa is faster

This may be pretty useful since if a user gets an output that contains unwanted entries, they can easily tweak filtration settings.

Tl;dr: Use the workaround from https://github.com/pwndbg/pwndbg/pull/322/files only for broken gdb versions

Problem in MISP/app/Lib/Export/NidsExport.php /
causes there are two rows in beggening of all rules regarding email. Bug is in row 161

case 'email':
$this->emailSrcRule($ruleFormat, $item['Attribute'], $sid);
$this->emailDstRule($ruleFormat, $item['Attribute'], $sid);
break;
this causes inserting both source and destinati

Seeing PGO: UNKNOWN is not implemented yet! printed out when parsing the following assembly

global main
extern GetStdHandle
extern WriteFile

section .text
main:
    mov     rcx, 0fffffff5h
    call    GetStdHandle

    mov     rcx, rax
    mov     rdx, NtlpBuffer
    mov     r8, [NtnNBytesToWrite]
    mov     r9, NtlpNBytesWritten
    sub     rsp, 40
    mov     dword [rs

I noticed that a sample that was analyzed fine with capa 1.6 cause errors now with capa 2.0
This was tested on an Ubuntu 18.04 with REMnux, but the issue is the same with the release file downloaded from github.

Results with capa 2.0

$ ./capa notPetya.dll 
loading : 100%|█████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

Some old programs versions can be found here if someone needs them to test old exploits for instance.