Skip to content

Commit

Permalink
(fix) Add rule: EasyProtector (rednaga#422)
Browse files Browse the repository at this point in the history
* Add EasyProtecter

* fix typo
  • Loading branch information
AbhiTheModder authored Nov 19, 2024
1 parent d982981 commit 5d4c5da
Showing 1 changed file with 17 additions and 0 deletions.
17 changes: 17 additions & 0 deletions apkid/rules/elf/protectors.yara
Original file line number Diff line number Diff line change
Expand Up @@ -591,3 +591,20 @@ rule nhn_appguard : protector
condition:
is_elf and any of ($class*) and ( $lib or $str_app or $payload )
}

rule easyprotector : protector
{
meta:
description = "EasyProtector"
url = "https://github.com/lamster2018/EasyProtector"
sample = "788ebabd9b5464c5e86b3832e4a7b6e7c91cce5603ff17f214429400ba3bb2b9" // net.crigh.cgsport
author = "Abhi"

strings:
$lib = "\x00libantitrace.so\x00"
$log = "\x00I was be traced...trace pid:%d\x00"
$log2 = "\x00ptrace myself...\x00"
condition:
is_elf and all of them
}

0 comments on commit 5d4c5da

Please sign in to comment.