malware-analysis

Description

Please describe what are you missing or wanting to be improved
Recently I read a new syntax coloring technique for programing languages. Instead of highlighting grammar, highlight the things you are likely to mistake. So make sure strcpy and strncpy are easily distinguishable by their color. It would be cool to apply this to immediate values in assembly and the ? command

$ poetry run pywhat "b8cedc00407a4c56a3bda1ed605c6fc1"
Matched on: b8cedc00407a4c56a3bda1ed605c6fc1
Name: Datadog API Key
Exploit: Use the command below to verify that the API key is valid:
  $ curl -X GET https://api.datadoghq.com/api/v1/validate -H "Content-Type: application/json" -H "DD-API-KEY:
b8cedc00407a4c56a3bda1ed605c6fc1"

It's too broad and matches on any 32 character hex

Tl;dr: Use the workaround from https://github.com/pwndbg/pwndbg/pull/322/files only for broken gdb versions

Problem in MISP/app/Lib/Export/NidsExport.php /
causes there are two rows in beggening of all rules regarding email. Bug is in row 161

case 'email':
$this->emailSrcRule($ruleFormat, $item['Attribute'], $sid);
$this->emailDstRule($ruleFormat, $item['Attribute'], $sid);
break;
this causes inserting both source and destinati

Seeing PGO: UNKNOWN is not implemented yet! printed out when parsing the following assembly

global main
extern GetStdHandle
extern WriteFile

section .text
main:
    mov     rcx, 0fffffff5h
    call    GetStdHandle

    mov     rcx, rax
    mov     rdx, NtlpBuffer
    mov     r8, [NtnNBytesToWrite]
    mov     r9, NtlpNBytesWritten
    sub     rsp, 40
    mov     dword [rs

https://hakibenita.com/python-mypy-exhaustive-checking

use assert_never in places like this: https://github.com/mandiant/capa/blob/b9f1fe56c8c6d6a881bb9bb34d0c5ea7dedbcdd3/capa/rules.py#L1093