vmray: escape characters

[mr-tz]

raw:

<deref type="str" value="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs"/>

parsed feature currently:

call 354: RegOpenKeyExA(SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs, 0, 131097)

should unescape the \\ and other similar items

[mr-tz]

@mike-hunhoff, can you do a sanity check for me here...?

does https://github.com/mandiant/capa-rules/pull/938/files work for you with https://github.com/mandiant/capa-testfiles/blob/tests/add-data/dynamic/vmray/86d8257ae56e5d8220a4e3f8396d944b5e9e41732b58ad7472276d78aea232fa_min_archive.zip

[mr-tz]

Matt confirmed that it doesn't work. Still need to find where it's going wrong.

[mr-tz]

I think this may be where we need to improve String feature extraction:

capa/capa/features/extractors/vmray/call.py

Line 30 in 591a1e8

yield String(param.deref.value), ch.address

[mike-hunhoff]

Yes, appears to be a bug in the string extraction. Updating the rule to use /SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\RecentDocs/i works. I'll push a fix.

[mr-tz]

raw summary JSON vs. XML

❯ grep "SOFTWARE" -C2 7244847/logs/summary_v2.json                                                                                                                                                                                           
      ],
      "original_reg_key_names": [
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs"
      ],
      "reg_key_name": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs",
      "verdict": "clean",
      "ref_gfncalls": [

❯ grep "SOFTWARE" -C2 7244847/logs/flog.xml                                                                                                                                                                                                  
		<param name="hKey" type="void_ptr" value="0xffffffff80000001"/>
		<param name="lpSubKey" type="ptr" value="0x5b490ff544">
			<deref type="str" value="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs"/>
		</param>
		<param name="ulOptions" type="unsigned_32bit" value="0x0"/>

[mr-tz]

I think this may be where we need to improve String feature extraction:

capa/capa/features/extractors/vmray/call.py

Line 30 in 591a1e8

yield String(param.deref.value), ch.address

adding param.deref.value.replace("\\\\", "\\") does the trick here for me