mandiant/capa-rules

false negative for screenshot

Open

#981 opened on 2025年1月17日

GitHub で見る
 (7 comments) (0 reactions) (1 assignee) (234 forks)github user discovery
false negativegood first issuehelp wanted

Repository metrics

Stars
 (721 stars)
PR merge metrics
 (PR metrics pending)

説明

nice example - false negative for the more specific branch GetDC/BitBlt/CreateCompatibleDC.

maybe we need to:

  • add DISPLAY* to CreateDC
  • add Gdip routines (GdipCreateBitmapFromScan0, GdipGetImageGraphicsContext, GdipGetDC)

Originally posted by @williballenthin in https://github.com/mandiant/capa/pull/2532#discussion_r1920802278

コントリビューターガイド