Skip to content

GhidraMAT v1.0

Latest

Choose a tag to compare

@HalfTimeOfLife HalfTimeOfLife released this 07 Sep 08:49

What's new

Runtime-constructed string detection

GhidraMAT can now detect strings built character by character at runtime via sequences of immediate byte stores (MOV byte/word/dword/qword ptr [reg+offset], imm).

Reconstructed candidates are matched against all existing signature files. Matched strings produce a Finding with the category, severity, and MITRE tag of the corresponding signature. Unmatched strings are collected in a dedicated section at the end of the report.

Full documentation

  • CHANGELOG.md covering all versions from v0.1
  • CONTRIBUTING.md: how to add signatures, naming conventions, how to run tests
  • README.md: updated architecture, runtime string detection, full walkthrough on a real Remcos RAT sample (334c23c9...) with 96 findings across 6 categories and a CRITICAL risk score

Validated against

Sample SHA256 Result
Remcos RAT 334c23c94f9c6587e2afd0689796daa8791fda9b823b23836893b86f5cce849f 96 findings, CRITICAL
Custom volatile C binary 298efffc010c72f2e5216a586244b9ae4dd51e48b1b759b35b535ababe6220b3 runtime_strings: VMware Inc., HKLM\SOFTWARE\..., netsh firewall...