Commit ba29e3f in #3057 fixed MissingExampleOffset to read scopes.static instead of the obsolete scope key. The lint was previously dead code and never triggered. Now it correctly flags 5 rules with function or basic block scope whose examples lack an offset (hash:0xADDRESS format):
attach BPF to socket on Linux (basic block) — sample availablelog keystrokes via direct input (function) — sample availableopen RecentDocs registry key (basic block) — sample not in tests/datapersist via ShellServiceObjectDelayLoad registry key (function) — sample not in tests/dataregister raw input devices (basic block) — sample not in tests/data
Two rules can be fixed immediately (samples in tests/data). The other three need samples sourced before offsets can be determined.
Commit ba29e3f in #3057 fixed
MissingExampleOffsetto readscopes.staticinstead of the obsoletescopekey. The lint was previously dead code and never triggered. Now it correctly flags 5 rules withfunctionorbasic blockscope whose examples lack an offset (hash:0xADDRESSformat):attach BPF to socket on Linux(basic block) — sample availablelog keystrokes via direct input(function) — sample availableopen RecentDocs registry key(basic block) — sample not in tests/datapersist via ShellServiceObjectDelayLoad registry key(function) — sample not in tests/dataregister raw input devices(basic block) — sample not in tests/dataTwo rules can be fixed immediately (samples in tests/data). The other three need samples sourced before offsets can be determined.