forked from mandiant/capa-rules
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathvalidate-payment-card-number-using-luhn-algorithm-with-lookup-table.yml
70 lines (70 loc) · 1.97 KB
/
validate-payment-card-number-using-luhn-algorithm-with-lookup-table.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
rule:
meta:
name: validate payment card number using luhn algorithm with lookup table
authors:
- "@_re_fox"
lib: true
scope: function
mbc:
- Data::Checksum::Luhn [C0032.002]
examples:
- 1d8fd13c890060464019c0f07b928b1a:0x401920
- 60abaef3fda131ffa20df480cb3f8029:0x4048e0
features:
- and:
- not:
- characteristic: nzxor
- characteristic: loop
description: Iterate over CC digits
- basic block:
- or:
- 8 or more:
- description: Digital root lookup table
- number: 0x0
- number: 0x2
- number: 0x4
- number: 0x6
- number: 0x8
- number: 0x1
- number: 0x3
- number: 0x5
- number: 0x7
- number: 0x9
- 8 or more:
- description: Digital root lookup table via neg numbers
- number: 0x0
- number: 0x1
- number: 0x2
- number: 0x3
- number: 0x4
- number: 0xfffffffc
- number: 0xfffffffd
- number: 0xfffffffe
- number: 0xffffffff
- or:
- instruction:
- description: Conversion of chr to int (SUB 0x30)
- number: 0x30
- mnemonic: sub
- instruction:
- description: Conversion of chr to int (LEA REG,[REG+ -0x30])
- mnemonic: lea
- offset: -0x30
- basic block:
- or:
- and:
- description: Final section returning checkum % 10
- mnemonic: idiv
- mnemonic: cdq
- number: 0xa
- optional:
- mnemonic: neg
- and:
- description: Compiler optimized returning checkum % 10
- mnemonic: shr
- mnemonic: imul
- number: 0x66666667
- number: 0x1f
- number: 0x2
- optional:
- mnemonic: neg