Improve output quality of real malware samples

Open
  • Is something wrong?
#16 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
cpp
Domain
reverse-engineering

Research direction

Start with the two sample hashes and samples.zip, then reproduce the reported string-in-function-call and empty-function-body output in the plugin. Compare the generated analysis with the listed expectations and identify the relevant regression-test location; done means the samples no longer show those defects and regression tests cover them.

Written by the indexing model from the issue text.

Description

enhancement P-output

Investigate problems in these samples. solve them, and add regression tests: samples.zip(MALWARE!).

89442e72227b209b7fcbe467a6b202c1788b850bdfbb52fa22c7762a45b1737c

  • Strings in function calls:
OutputDebugStringW(L"It was a joke about heroin, but now im going to sell heroin to your mother :P");
CreateMutexW(0, 0, L"Local\\Fabiansomware");
StrStrW(&ExistingFileName, L"winlogon.exe");
  • Overall quality.

20AE07CC27965D330314776C16E8FAA3FA021AB7E4C6FFC86A3593AC4010BDFE.dat:

  • Empty functions bodies: WinMain, sub_4018E0, sub_401870, etc.
  • Overall quality.
Dominant language
C++
Stars
799
Forks
132
No merged PRs in 30d

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from avast/retdec-idaplugin

All issues in avast/retdec-idaplugin

Similar issues

More C++ issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.