Update and add Cabinet archive related rules #808
Conversation
|
@mike-hunhoff, can you take a look? |
|
@mike-hunhoff bump :) |
There was a problem hiding this comment.
Thank you @jtothej ! I'm not sure why I missed all of the mentions here and I apologize for the delayed review. Please check out my comments.
| @@ -0,0 +1,23 @@ | |||
| rule: | |||
| meta: | |||
| name: create Cabinet file | |||
There was a problem hiding this comment.
Thoughts on changing this to create Cabinet on Windows to make it more clear?
There was a problem hiding this comment.
Thanks! Renamed the rule in ac09516
| - or: | ||
| - api: cabinet.FCIAddFile = add file to Cabinet | ||
| - api: cabinet.FCIFlushFolder = flush current folder under construction | ||
| - api: cabinet.FCIFlushCabinet = completes current cabinet |
There was a problem hiding this comment.
Add cabinet.FCIDestroy?
There was a problem hiding this comment.
Thanks! Added in ac09516
| @@ -0,0 +1,21 @@ | |||
| rule: | |||
| meta: | |||
| name: extract files from Cabinet | |||
There was a problem hiding this comment.
Thoughts on changing this to extract Cabinet on Windows to make it more clear?
There was a problem hiding this comment.
Thanks! Renamed the rule in ac09516
| @@ -1,12 +1,14 @@ | |||
| rule: | |||
| meta: | |||
| name: open cabinet file | |||
| namespace: host-interaction/file-system | |||
| name: create File Compression Interface context | |||
There was a problem hiding this comment.
Thoughts on adding on Windows to make it more clear?
There was a problem hiding this comment.
Thanks! Renamed the rule in ac09516
| @@ -0,0 +1,14 @@ | |||
| rule: | |||
| meta: | |||
| name: create File Decompression Interface context | |||
There was a problem hiding this comment.
Thoughts on adding on Windows to make it more clear?
There was a problem hiding this comment.
Thanks! Renamed the rule in ac09516
Suggesting following rearrangement as FCI/FDI API functions are dependent on each other so I'm not sure if it's worth to have separate rules for each of them:
FCICreateandFDICreatecan be potentially used for shellcode execution via callback functions (TODO) so adding them as library functions:lib/create-file-compression-interface-context.ymllib/create-file-decompression-interface-context.ymlRules indicating creation or extraction of data from Cabinet file:
data-manipulation/compression/create-cabinet-file.ymldata-manipulation/compression/extract-files-from-cabinet.ymlCC: @mike-hunhoff