Rename architecture-specific rules and update rule names inside YAML files

anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml → anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: check for PEB NtGlobalFlag flag
+    name: check for PEB NtGlobalFlag flag via x86 assembly
     namespace: anti-analysis/anti-debugging/debugger-detection
     authors:
       - [email protected]

anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml → anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: check for trap flag exception
+    name: check for trap flag exception via x86 assembly
     namespace: anti-analysis/anti-debugging/debugger-detection
     authors:
       - [email protected]

anti-analysis/anti-debugging/debugger-detection/execute-anti-debugging-instructions.yml → anti-analysis/anti-debugging/debugger-detection/execute-anti-debugging-instructions-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: execute anti-debugging instructions
+    name: execute anti-debugging instructions via x86 assembly
     namespace: anti-analysis/anti-debugging/debugger-detection
     authors:
       - [email protected]

anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml → anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: 64-bit execution via heavens gate
+    name: 64-bit execution via heavens gate via x86 assembly
     namespace: anti-analysis/anti-disasm
     authors:
       - [email protected]

communication/socket/tcp/send/obtain-transmitpackets-callback-function-via-wsaioctl.yml → communication/socket/tcp/send/obtain-transmitpackets-callback-function-via-wsaioctl-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: obtain TransmitPackets callback function via WSAIoctl
+    name: obtain TransmitPackets callback function via WSAIoctl via x86 assembly
     namespace: communication/socket/tcp/send
     authors:
       - [email protected]

data-manipulation/checksum/adler32/compute-adler32-checksum.yml → data-manipulation/checksum/adler32/compute-adler32-checksum-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: compute adler32 checksum
+    name: compute adler32 checksum via x86 assembly
     namespace: data-manipulation/checksum/adler32
     authors:
       - [email protected]

data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml → data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: encrypt data using RC4 KSA
+    name: encrypt data using RC4 KSA via x86 assembly
     namespace: data-manipulation/encryption/rc4
     authors:
       - [email protected]

data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml → data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: encrypt data using RC4 PRGA
+    name: encrypt data using RC4 PRGA via x86 assembly
     namespace: data-manipulation/encryption/rc4
     authors:
       - [email protected]

data-manipulation/encryption/rsa/encrypt-data-using-rsa-via-embedded-library.yml → data-manipulation/encryption/rsa/encrypt-data-using-rsa-via-embedded-library-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: encrypt data using RSA via embedded library
+    name: encrypt data using RSA via embedded library via x86 assembly
     namespace: data-manipulation/encryption/rsa
     authors:
       - "Ana06"

host-interaction/hardware/cpu/get-number-of-processors.yml → host-interaction/hardware/cpu/get-number-of-processors-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: get number of processors
+    name: get number of processors via x86 assembly
     namespace: host-interaction/hardware/cpu
     authors:
       - [email protected]

host-interaction/process/get-process-filename.yml → host-interaction/process/get-process-filename-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: get process filename
+    name: get process filename via x86 assembly
     namespace: host-interaction/process
     authors:
       - [email protected]

host-interaction/process/get-process-heap-flags.yml → host-interaction/process/get-process-heap-flags-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: get process heap flags
+    name: get process heap flags via x86 assembly
     namespace: host-interaction/process
     authors:
       - [email protected]

host-interaction/process/get-process-heap-force-flags.yml → host-interaction/process/get-process-heap-force-flags-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: get process heap force flags
+    name: get process heap force flags via x86 assembly
     namespace: host-interaction/process
     authors:
       - [email protected]

lib/calculate-modulo-256-via-x86-assembly.yml → lib/calculate-modulo-256-via-x86-assembly-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: calculate modulo 256 via x86 assembly
+    name: calculate modulo 256 via x86 assembly via x86 assembly
     authors:
       - [email protected]
     lib: true

lib/contain-pusha-popa-sequence.yml → lib/contain-pusha-popa-sequence-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: contain pusha popa sequence
+    name: contain pusha popa sequence via x86 assembly
     authors:
       - [email protected]
     lib: true

lib/peb-access.yml → lib/peb-access-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: PEB access
+    name: PEB access via x86 assembly
     authors:
       - [email protected]
     lib: true

linking/runtime-linking/access-peb-ldr_data.yml → linking/runtime-linking/access-peb-ldr_data-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: access PEB ldr_data
+    name: access PEB ldr_data via x86 assembly
     namespace: linking/runtime-linking
     authors:
       - [email protected]

linking/runtime-linking/get-kernel32-base-address.yml → linking/runtime-linking/get-kernel32-base-address-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: get kernel32 base address
+    name: get kernel32 base address via x86 assembly
     namespace: linking/runtime-linking
     authors:
       - [email protected]

linking/runtime-linking/get-ntdll-base-address.yml → linking/runtime-linking/get-ntdll-base-address-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: get ntdll base address
+    name: get ntdll base address via x86 assembly
     namespace: linking/runtime-linking
     authors:
       - [email protected]

nursery/execute-syscall.yml → nursery/execute-syscall-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: execute syscall
+    name: execute syscall via x86 assembly
     namespace: anti-analysis
     authors:
       - "@kulinacs"

nursery/get-ntoskrnl-base-address.yml → nursery/get-ntoskrnl-base-address-via-x86-assembly.yml

@@ -1,9 +1,10 @@
 rule:
   meta:
-    name: get ntoskrnl base address
+    name: get ntoskrnl base address via x86 assembly
     namespace: linking/runtime-linking
     authors:
       - "@mr-tz"
+      - "@akh7177"
     scopes:
       static: function
       dynamic: unsupported  # requires offset features
@@ -19,9 +20,11 @@ rule:
           - description: returns RTL_PROCESS_MODULES structure
           - number: 0xB = SystemModuleInformation
           - match: get system information on Windows
-      - and:
-        - arch: i386
-        - offset: 0xC = RTL_PROCESS_MODULES.Modules[0].ImageBase
-      - and:
-        - arch: amd64
-        - offset: 0x18 = RTL_PROCESS_MODULES.Modules[0].ImageBase
+      - or:
+        - and:
+          - arch: i386
+          - offset: 0xC = RTL_PROCESS_MODULES.Modules[0].ImageBase
+        - and:
+          - arch: amd64
+          - offset: 0x18 = RTL_PROCESS_MODULES.Modules[0].ImageBase
+

nursery/hook-routines-via-dlsym-rtld_next.yml → nursery/hook-routines-via-dlsym-rtld_next-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: hook routines via dlsym RTLD_NEXT
+    name: hook routines via dlsym RTLD_NEXT via x86 assembly
     namespace: linking/hooking
     authors:
       - [email protected]

nursery/reference-processor-manufacturer-constants.yml → nursery/reference-processor-manufacturer-constants-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: reference processor manufacturer constants
+    name: reference processor manufacturer constants via x86 assembly
     namespace: anti-analysis/anti-vm/vm-detection
     authors:
       - [email protected]