-
Notifications
You must be signed in to change notification settings - Fork 394
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: filter file capture by ELF type #3361
feat: filter file capture by ELF type #3361
Conversation
2b14f7f
to
bda9ec7
Compare
01a5a31
to
ce9375b
Compare
file_id.ctime = 0; | ||
if (start_pos == 0) { | ||
// Check if header is matching ELF header | ||
u8 header[FILE_MAGIC_HDR_SIZE] = {}; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Shouldn't this array be initialized to 0?
This can be important if header size is less than FILE_MAGIC_HDR_SIZE
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
So using the syntax of x = {}
should initialized the value to zero as far as I know.
I have checked it once with @roikol and it worked.
Add a filter for file IO capture filtering ELF files. ELF files are the most important files to capture in security research, so filtering according to ELF files is very effective to reduce noise.
ce9375b
to
20635b9
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
This reverts commit fd47dfb.
1. Explain what the PR does
Add a filter for file IO capture filtering ELF files. ELF files are the most important files to capture in security research, so filtering according to ELF files is very effective to reduce noise.
fix #3359