Closed AlexVanMechelen closed 4 months ago
@AlexVanMechelen You can use comments (with #
) to specify the source where you found your entries. We can for instance integrate those of this source.
@dhondta The current ones in this PR follow from own analysis on dataset-packed-pe (see Appendix B). I'll add the ones from the source you included here above, as they likely follow from a larger scale analysis & to avoid overfitting to our dataset.
@dhondta On the other hand, the api's from the source you included are common in malware. Packers will typically try to hide those malicious api calls by dynamically loading them or other obfuscation techniques. The functions from our analysis (Appendix B) might be more tailored to packers. I might include both groups
@dhondta List updated.
Do you have suggestions for better ways of implementing those?
@AlexVanMechelen There are two ways:
data
folder, based on the file you propose in this PR. This way, we let this list up to the researcher either by using our default list from the data
folder provided with the Packing Box or in the scope of his/her experiment with a dedicated data
folder. This allows for more flexibility.I will solve your issue of suffixes with a simple script for which I will keep the code in a Wiki page not to "pollute" the data
folder.
This PR adds: