Skip to content

Add rule for LZMA decompression#1152

Open
edeca wants to merge 1 commit intomandiant:masterfrom
edeca:master
Open

Add rule for LZMA decompression#1152
edeca wants to merge 1 commit intomandiant:masterfrom
edeca:master

Conversation

@edeca
Copy link
Copy Markdown
Contributor

@edeca edeca commented Apr 13, 2026

Added a rule to detect the LzmaProps_Decode function from LZMA.

Compared to other LZMA routines this code contains useful constants and is relatively static - e.g. it does not depend on the compression level and does not use small power-of-two constants.

A sample executable is referenced. This is not the one which I used to develop the rule, but contains almost identical code which can be used as a test case.

@google-cla
Copy link
Copy Markdown

google-cla Bot commented Apr 13, 2026

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant