adding new and updating linux / android rules (#903)

* adding new and updating linux / android rules * fix lints
mandiant · May 31, 2024 · ded2744 · ded2744
1 parent c0de9d7
commit ded2744
Show file tree

Hide file tree

Showing 6 changed files with 79 additions and 1 deletion.
diff --git a/host-interaction/file-system/change-file-permission-on-linux.yml b/host-interaction/file-system/change-file-permission-on-linux.yml
@@ -4,6 +4,7 @@ rule:
     namespace: host-interaction/file-system
     authors:
       - [email protected]
+      - [email protected]
     scopes:
       static: basic block
       dynamic: call
@@ -13,9 +14,14 @@ rule:
       - 7351f8a40c5450557b24622417fc478d:0x407C68
   features:
     - and:
-      - os: linux
+      - or:
+        - os: android
+        - os: linux
       - or:
         - api: chown
         - api: fchown
         - api: lchown
         - api: fchownat
+        - api: chmod
+        - api: fchmod
+        - api: fchmodat
diff --git a/host-interaction/process/create/create-process-on-linux.yml b/host-interaction/process/create/create-process-on-linux.yml
@@ -4,6 +4,7 @@ rule:
     namespace: host-interaction/process/create
     authors:
       - [email protected]
+      - [email protected]
     scopes:
       static: basic block
       dynamic: call
@@ -27,3 +28,4 @@ rule:
         - api: posix_spawn
         - api: posix_spawnp
         - api: popen
+        - api: fork
diff --git a/nursery/change-memory-permission-on-linux.yml b/nursery/change-memory-permission-on-linux.yml
@@ -0,0 +1,17 @@
+rule:
+  meta:
+    name: change memory permission on Linux
+    namespace: host-interaction/memory
+    authors:
+      - [email protected]
+    scopes:
+      static: function
+      dynamic: call
+  features:
+    - and:
+      - or:
+        - os: linux
+        - os: android
+      - or:
+        - api: mprotect
+        - api: pkey_mprotect
diff --git a/nursery/check-file-permission-on-linux.yml b/nursery/check-file-permission-on-linux.yml
@@ -0,0 +1,17 @@
+rule:
+  meta:
+    name: check file permission on Linux
+    namespace: host-interaction/file-system
+    authors:
+      - [email protected]
+    scopes:
+      static: function
+      dynamic: call
+  features:
+    - and:
+      - or:
+        - os: android
+        - os: linux
+      - or:
+        - api: access
+        - api: faccessat
diff --git a/nursery/check-if-process-is-running-under-android-emulator-on-android.yml b/nursery/check-if-process-is-running-under-android-emulator-on-android.yml
@@ -0,0 +1,19 @@
+rule:
+  meta:
+    name: check if process is running under Android emulator on Android
+    namespace: anti-analysis/anti-emulation/android
+    authors:
+      - [email protected]
+    scopes:
+      static: function
+      dynamic: call
+    references:
+      - https://github.com/happylishang/AntiFakerAndroidChecker/blob/master/antifake/src/main/jni/emulator/emcheck64.c
+  features:
+    - and:
+      - or:
+        - os: linux
+        - os: android
+      - string: "com/snail/antifake/jni/EmulatorDetectUtil"
+      - optional:
+        - string: "getSystemArch"
diff --git a/nursery/map-or-unmap-memory-on-linux.yml b/nursery/map-or-unmap-memory-on-linux.yml
@@ -0,0 +1,17 @@
+rule:
+  meta:
+    name: map or unmap memory on Linux
+    namespace: host-interaction/memory
+    authors:
+      - [email protected]
+    scopes:
+      static: function
+      dynamic: call
+  features:
+    - and:
+      - or:
+        - os: linux
+        - os: android
+      - or:
+        - api: mmap
+        - api: munmap