Closed ruppde closed 7 months ago
- "@.didat" @ file+0x2F7
is this actually a reference to the IDA filename, or a FP? more generally, the four character pattern "ida[gqtuw]" seems like it might very easily show up in random strings. should we restrict it further, like ensuring its not found within a substring, but only a whole string?
- or:
- string: idag
- string: idaq
- string: idat
- string: idau
- string: idaw
- string: /ida[gqtuw]?\.exe/i
small filenames must be matched verbatim, as whole string, or longer filename can be a part of a longer string.
yes, fp.
I think the $ in the end prevents it from hitting any random substring.
or consider putting that string in its own rule which gets "potential" in the title?
thank you, @ruppde!
fix 2 problems:
ida
:405d4c2ef7419bf265edef0fe86c8ba1ed634b10dccaaa0a6c6b953645598619