wesinator commented 5 years ago

The PEiD Armadillo v1.71 signature has false positives on binaries compiled with MSVC https://github.com/cuckoosandbox/cuckoo/pull/2538

botherder commented 5 years ago

Can you provide some hashes to test?

wesinator commented 5 years ago

@botherder 6ac06dfa543dca43327d55a61d0aaed25f3c90cce791e0555e3e306d47107859 is an example binary that is not actually packed with Armadillo but detected by this signature.

codecov-io commented 5 years ago

Codecov Report

Merging #712 into master will increase coverage by 4.53%. The diff coverage is n/a.

@@            Coverage Diff            @@
##           master    #712      +/-   ##
=========================================
+ Coverage   40.56%   45.1%   +4.53%     
=========================================
  Files         129     130       +1     
  Lines       12680   14337    +1657     
=========================================
+ Hits         5144    6467    +1323     
- Misses       7536    7870     +334

Impacted Files	Coverage Δ
viper/modules/pe.py	`29.52% <0%> (-3.48%)`	:arrow_down:
viper/web/viperapi/serializers.py	`61.02% <0%> (-1.61%)`	:arrow_down:
viper/modules/strings.py	`22.99% <0%> (-0.57%)`	:arrow_down:
viper/modules/misp.py	`55.16% <0%> (-0.23%)`	:arrow_down:
viper/web/viperapi/views.py	`49.89% <0%> (-0.11%)`	:arrow_down:
viper/web/viperweb/views.py	`19.45% <0%> (-0.09%)`	:arrow_down:
viper/modules/size.py	`22.1% <0%> (ø)`	:arrow_up:
viper/modules/lief.py	`86.23% <0%> (ø)`
viper/modules/misp_methods/check_hashes.py	`9.94% <0%> (+0.11%)`	:arrow_up:
viper/modules/office.py	`54.84% <0%> (+0.12%)`	:arrow_up:
... and 1 more

Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update 88e32bb...e6c68a0. Read the comment docs.

viper-framework / viper

Remove false positive PEiD Armadillo packer signatures #712

Codecov Report