mirror of
https://github.com/horsicq/Detect-It-Easy.git
synced 2026-06-24 01:54:08 +00:00
Add PE detection rule for Brotli library
Add db/PE/library_Brotli.4.sg to detect the Google Brotli library in PE files. The rule checks for library names matching brotlidec/brotlienc and for exported functions starting with BrotliDecoder or BrotliEncoder; when only exports are present it sets sOptions to "static". File includes author/contact metadata.
This commit is contained in:
parent
bbc91ca478
commit
2902dc790d
1 changed files with 20 additions and 0 deletions
20
db/PE/library_Brotli.4.sg
Normal file
20
db/PE/library_Brotli.4.sg
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
// Detect It Easy: detection rule file
|
||||
|
||||
// Author: DosX
|
||||
// E-Mail: collab@kay-software.ru
|
||||
// GitHub: https://github.com/DosX-dev
|
||||
// Telegram: @DosX_dev
|
||||
|
||||
// https://github.com/google/brotli
|
||||
meta("library", "Brotli");
|
||||
|
||||
function detect() {
|
||||
if (PE.isLibraryPresentExp(/brotli(?:dec|enc)/i)) {
|
||||
bDetected = true;
|
||||
} else if (PE.isExportFunctionPresentExp(/^Brotli(?:Decoder|Encoder)/)) {
|
||||
sOptions = "static"; // EAT
|
||||
bDetected = true;
|
||||
}
|
||||
|
||||
return result();
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue