apply review feedback

mandiant · Jun 6, 2024 · 6fedeac · 6fedeac
1 parent 885ea24
commit 6fedeac
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 1 deletion.
diff --git a/host-interaction/file-system/write/write-file-on-linux.yml b/host-interaction/file-system/write/write-file-on-linux.yml
@@ -29,6 +29,8 @@ rule:
         - api: fwrite
         - api: putwchar
         - api: dprintf
+        - api: vdprintf
         - api: fprintf
+        - api: vfprintf
       - optional:
         - match: create or open file
diff --git a/host-interaction/process/create/create-process-on-linux.yml b/host-interaction/process/create/create-process-on-linux.yml
@@ -22,7 +22,7 @@ rule:
         - and:
           - match: execute syscall
           - arch: aarch64
-          - number: 0xdd
+          - number: 0xdd = execve
         - api: execl
         - api: execlp
         - api: execle

diff --git a/nursery/truncate-file-on-linux.yml b/nursery/truncate-file-on-linux.yml
@@ -9,4 +9,7 @@ rule:
       dynamic: call
   features:
     - and:
+      - or:
+        - os: android
+        - os: linux
       - api: ftruncate