update linux/android rules and reduce fps for intel-specific rules (#927)

* android: add / update rules

* intel: match intel archs to avoid fps on others
This commit is contained in:
Mike Hunhoff
2024-08-16 12:57:08 -06:00
committed by GitHub
parent 10ca24c26b
commit 5b8c8a63a2
3 changed files with 25 additions and 0 deletions
@@ -13,3 +13,6 @@ rule:
- or:
- api: DbgPrint
- api: kernel32.OutputDebugString
- and:
- os: android
- api: __android_log_print
@@ -15,6 +15,9 @@ rule:
# and ecx, 800000FFh
# and ecx, 0FFh
- and:
- or:
- arch: i386
- arch: amd64
- mnemonic: and
- or:
- number: 0x800000FF
+19
View File
@@ -0,0 +1,19 @@
rule:
meta:
name: delete file on Linux
namespace: host-interaction/file-system/delete
authors:
- [email protected]
scopes:
static: basic block
dynamic: call
mbc:
- File System::Delete File [C0047]
features:
- and:
- or:
- os: linux
- os: android
- or:
- api: unlink
- api: unlinkat