What's new
Runtime-constructed string detection
GhidraMAT can now detect strings built character by character at runtime via sequences of immediate byte stores (MOV byte/word/dword/qword ptr [reg+offset], imm).
Reconstructed candidates are matched against all existing signature files. Matched strings produce a Finding with the category, severity, and MITRE tag of the corresponding signature. Unmatched strings are collected in a dedicated section at the end of the report.
Full documentation
CHANGELOG.mdcovering all versions from v0.1CONTRIBUTING.md: how to add signatures, naming conventions, how to run testsREADME.md: updated architecture, runtime string detection, full walkthrough on a real Remcos RAT sample (334c23c9...) with 96 findings across 6 categories and a CRITICAL risk score
Validated against
| Sample | SHA256 | Result |
|---|---|---|
| Remcos RAT | 334c23c94f9c6587e2afd0689796daa8791fda9b823b23836893b86f5cce849f |
96 findings, CRITICAL |
| Custom volatile C binary | 298efffc010c72f2e5216a586244b9ae4dd51e48b1b759b35b535ababe6220b3 |
runtime_strings: VMware Inc., HKLM\SOFTWARE\..., netsh firewall... |