Import analyzer plugin rule suggestions

Question

Import analyzer plugin rule suggestions

henke37 opened this issue 8 years ago · comments

Henrik "Henke37" Andersson commented 8 years ago

EnumDeviceDrivers|GetDeviceDriverFileNameW Checks for drivers
EvtClearLog|ClearEventLog Empties the system event log
TerminateProcess Messes with other processes
PrintWindow Takes screenshots
SetKernelObjectSecurity|SetFileSecurity|SetNamedSecurityInfo|SetSecurityInfo Manipulates DACLs
OpenSCManagerW|CreateService|DeleteService Manipulates services
CoLoadLibrary Replacement for LoadLibrary

Ivan Kwiatkowski · Answer 1 · Tue May 10 2016 22:33:31 GMT+0800 (China Standard Time)

Thanks a lot for these suggestions! They will be implemented shortly.

Ivan Kwiatkowski · Answer 2 · Sat May 21 2016 13:44:19 GMT+0800 (China Standard Time)

I just removed TerminateProcess from the list: turns out it gets imported by default in _report_gsfailure, which means that any /GS-protected binary would have it. The presence of this particular import is therefore not very meaningful.

Same goes for IsDebuggerPresent, which seems to be referenced in just any PE (from ___scrt_fastfail).