Improve Screenshot Detection by Modifying capture-screenshot.yml #1007
Conversation
…nclude GDI, GDIP and DirectX API calls
Improve Screenshot Detection by Modifying capture-screenshot.yml
| - and: | ||
| - or: | ||
| - api: "GetDC" | ||
| - and: | ||
| - api: "CreateDC" | ||
| - optional: | ||
| - string: "DISPLAY" | ||
| - or: | ||
| - and: | ||
| - api: "SelectObject" | ||
| - api: "DrawText" | ||
| - and: | ||
| - api: "CreateCompatibleDC" | ||
| - api: "CreateCompatibleBitmap" | ||
| - or: | ||
| - api: "BitBlt" | ||
| - api: "StretchBlt" | ||
| - api: "PrintWindow" |
There was a problem hiding this comment.
some of this seems to be duplicated from above, right? would you please merge the logic where reasonable?
There was a problem hiding this comment.
Hello @williballenthin ,
I've tried to remove the duplicated parts of the code and committed the changes. Please let me know if further improvements are required.
akh7177
force-pushed
the
add-screenshot-rule
branch
from
adb3858 to
4cd4879
Compare
akh7177
force-pushed
the
add-screenshot-rule
branch
from
9fe63a9 to
ea56ada
Compare
|
@akh7177 lints are failing now: You can run lints locally by installing capa for development using the instructions found here. |
…nclude GDI, GDIP and DirectX API calls
|
@mike-hunhoff I modified the file and made sure that it passes lint.py given that my new test binary is added . |
There was a problem hiding this comment.
Thanks @akh7177 , I noticed a few things and left comments for you to address.
| @@ -43,3 +47,31 @@ rule: | |||
| - and: | |||
| - api: BitBlt | |||
| - api: System.Drawing.Graphics::CopyFromScreen | |||
| - and: | |||
| - api: "SelectObject" | |||
There was a problem hiding this comment.
api features do not require ". Please remove the " from this api feature and all that follow.
| - api: "Gdiplus::Graphics::FromHDC" | ||
| - api: "Gdiplus::Graphics::CopyFromScreen" |
There was a problem hiding this comment.
Should these be api or function-name features?
There was a problem hiding this comment.
Hello @mike-hunhoff !
According to my understanding, Gdiplus is not from a statically linked library right?
| - api: "Direct3DCreate9" | ||
| - api: "IDirect3DDevice9::GetFrontBufferData" |
There was a problem hiding this comment.
Should these be api or function-name features?
There was a problem hiding this comment.
Over here too, Direct3DCreate 9 is a direct import of a dll file right?
There was a problem hiding this comment.
Furthermore, changing these features to function-name would require me to change the static scope of the rule to file. Would it not increase the number of false positives?
Added GDI, GDIP, and DirectX API calls to improve detection accuracy for various screenshot capture methods.
This detects screenshot capture that uses GDI+ routines as well as CreateDC with other arguments along with DISPLAY. The test files include two executables that demonstrate the improved detection.
closes #981