Closed williballenthin closed 10 months ago
eg.
host-interaction/wmi/connect-to-wmi-namespace-via-wbemlocator.yml 10: dynamic: unsupported # requires offset, bytes features 21: - bytes: 11 F8 90 45 3A 1D D0 11 89 1F 00 AA 00 4B 2E 24 = CLSID_WbemLocator 22: - bytes: 87 A6 12 DC 7F 73 CF 11 88 4D 00 AA 00 4B 2E 24 = IID_IWbemLocator anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml 29: description: call $+5 pushes the current EIP onto the stack, +5 to jump past call insn bytes 32: - number: 0x5 = length of add + retf insn bytes host-interaction/hardware/storage/enumerate-disk-properties.yml 9: dynamic: unsupported # requires bytes features 21: - bytes: 67 E9 36 4D 25 E3 CE 11 BF C1 08 00 2B E1 03 18 = GUID_DEVCLASS_DISKDRIVE host-interaction/hardware/enumerate-devices-by-category.yml 10: dynamic: unsupported # requires offset, bytes features 18: - bytes: 10 5D BE 62 EB 60 D0 11 BD 3B 00 A0 C9 11 CE 86 = SystemDeviceEnum 19: - bytes: 22 08 84 29 84 5B D0 11 BD 3B 00 A0 C9 11 CE 86 = ICreateDevEnum 23: - bytes: 10 B3 0B 86 01 5D D0 11 BD 3B 00 A0 C9 11 CE 86 = CVidCapClassManager 24: - bytes: 62 A7 D9 33 C8 90 D0 11 BD 43 00 A0 C9 11 CE 86 = CWaveinClassManager host-interaction/uac/bypass/bypass-uac-via-icmluautil.yml 21: - bytes: F9 C7 5F 3E 51 9A 67 43 90 63 A1 20 24 4F BE C7 = T_CLSID_CMSTPLUA 28: - bytes: 74 6D DD 6E 07 C0 75 4E B7 6A E5 74 09 95 E2 4C = IID_ICMLuaUtil host-interaction/uac/bypass/bypass-uac-via-rpc.yml 25: - bytes: 9A F9 1E 20 A0 7F 4C 44 93 99 19 BA 84 F1 2A 1A = IID_APPINFO
this requires v7 functionality from https://github.com/mandiant/capa/pull/1738
eg.