forked from mandiant/capa-rules
-
Notifications
You must be signed in to change notification settings - Fork 0
/
validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml
80 lines (80 loc) · 2.41 KB
/
validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
rule:
meta:
name: validate payment card number using luhn algorithm with no lookup table
authors:
- "@_re_fox"
lib: true
scopes:
static: function
dynamic: unsupported # requires characteristic, offset, mnemonic features
mbc:
- Data::Checksum::Luhn [C0032.002]
examples:
- 6fcc13563aad936c7d0f3165351cb453:0x4026C0
features:
- and:
- characteristic: loop
description: Iterate over CC digits
- or:
- basic block:
- and:
# 6fcc13563aad936c7d0f3165351cb453:402842
- or:
- instruction:
- mnemonic: shl
- number: 0x1
- instruction:
- mnemonic: imul
- number: 0x2
- mnemonic: add = add al, al
- instruction:
- mnemonic: cmp
- number: 0x9
- description: Digital Root check number*2 < 0x9
- and:
- instruction:
- mnemonic: cmp
- number: 0x9
- description: Compare number to 0x9 for Digital Root
- basic block:
- or:
- instruction:
- mnemonic: imul
- number: 0x2
- instruction:
- mnemonic: shl
- number: 0x1
- mnemonic: add = add al, al
- description: 2*Number for Digital Root
- or:
- instruction:
# 6fcc13563aad936c7d0f3165351cb453:0x402820
- mnemonic: sub
- number: 0x30
- description: Conversion of chr to int (SUB 0x30)
- instruction:
- offset: -0x30
- mnemonic: lea
- description: Conversion of chr to int (LEA REG,[REG+ -0x30])
- basic block:
- or:
- and:
# 6fcc13563aad936c7d0f3165351cb453:0x402857
- or:
- mnemonic: div
- and:
- mnemonic: idiv
- mnemonic: cdq
- number: 0xa
- optional:
- mnemonic: neg
- description: Final section returning checkum % 10
- and:
- mnemonic: shr
- mnemonic: imul
- number: 0x66666667
- number: 0x1f
- number: 0x2
- optional:
- mnemonic: neg
- description: Compiler optimized returning checkum % 10