Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

identify .NET single file bundles #841

Closed
wants to merge 13 commits into from
Closed

identify .NET single file bundles #841

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
da035e2
identify .NET single file bundles
sara-rn Nov 9, 2023
fc0fda2
Update rules number badge
capa-bot Nov 9, 2023
3089ba8
Update bundled-with-dotnet-single-file-deployment.yml
sara-rn Nov 13, 2023
3396236
Delete README.md
sara-rn Nov 14, 2023
c9f2d7d
Update bundled-with-dotnet-single-file-deployment.yml
sara-rn Nov 14, 2023
08b3d5c
identify .net single bundles as a file limitation
sara-rn Nov 14, 2023
8e8a7d9
added single file deployment rule to executable/installer/dotnet
sara-rn Nov 15, 2023
2227807
lint + rule in executable/installer/dotnet
sara-rn Nov 15, 2023
7c31b3e
fixed namespace
sara-rn Nov 15, 2023
b649129
deleted older file limitation rule
sara-rn Nov 15, 2023
cbd07c0
added description
sara-rn Nov 15, 2023
56334a4
fixed format
sara-rn Nov 15, 2023
e15a1f7
Merge branch 'mandiant:master' into master
sara-rn Nov 17, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please remove this file from the PR

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yep, understood, didn't know how to I guess, can you reject this specific commit?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sorry, I meant from the changes, not to delete the file :)

Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# capa rules

[![Rule linter status](https://github.com/mandiant/capa-rules/workflows/CI/badge.svg)](https://github.com/mandiant/capa-rules/actions?query=workflow%3A%22CI%22)
[![Number of rules](https://img.shields.io/badge/rules-847-blue.svg)](rules)
[![Number of rules](https://img.shields.io/badge/rules-848-blue.svg)](rules)
[![License](https://img.shields.io/badge/license-Apache--2.0-green.svg)](LICENSE.txt)

This is the standard collection of rules for [capa](https://github.com/mandiant/capa) - the tool to automatically identify capabilities of programs.
Expand Down
20 changes: 20 additions & 0 deletions bundled-with-dotnet-single-file-deployment.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
rule:
meta:
name: bundled with .NET single-file deployment
namespace: runtime/dotnet
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should this go into the internal\limitation\file directory/namespace to avoid further processing?

authors:
- [email protected]
scope: file
references:
- https://learn.microsoft.com/en-us/dotnet/core/deploying/single-file/overview?tabs=cli
- https://github.com/dotnet/runtime/blob/84de9b678613675e0444b265905c82d33dae33a8/src/installer/managed/Microsoft.NET.HostModel/AppHost/HostWriter.cs
examples:
- a83339b07cf2bf1aeda192de42760c625d4b2f106260f58c902d02f4766848d5
features:
- or:
- and:
- match: contains PDB path
- string: "singlefilehost.pdb"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you add a description why this may be a good signal?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sure. this is the symbol file for the native executable when publish single file is set to True

description = symbol file for the native executable when publish single file is true
sara-rn marked this conversation as resolved.
Show resolved Hide resolved
- export: DotNetRuntimeInfo
- export: corehost_initialize
Loading