|
1 | 1 | { |
2 | 2 | "attributes": { |
3 | | - "function-name":{ |
4 | | - "description": "function name", |
5 | | - "misp-attribute": "text", |
6 | | - "ui-priority": 1, |
7 | | - "disable_correlation": true |
| 3 | + "bsim-signature": { |
| 4 | + "description": "BSIM signature of the vector", |
| 5 | + "misp-attribute": "hex", |
| 6 | + "ui-priority": 0 |
8 | 7 | }, |
9 | | - "label": { |
10 | | - "description": "ghidra symbol label(s) associated with the function", |
| 8 | + "bsim-vector": { |
| 9 | + "description": "comma separated BSIM Feature Vector", |
11 | 10 | "misp-attribute": "text", |
12 | | - "ui-priority": 0, |
13 | | - "disable_correlation": true, |
14 | | - "multiple": true |
| 11 | + "ui-priority": 0 |
15 | 12 | }, |
16 | | - "function-scope": { |
17 | | - "description": "ghidra function scope (export, import, internal)", |
18 | | - "misp-attribute": "text", |
19 | | - "ui-priority": 0, |
| 13 | + "calling-convention": { |
| 14 | + "description": "The calling convention used by the function (e.g., cdecl, stdcall)", |
20 | 15 | "disable_correlation": true, |
21 | | - "sane_default": [ |
22 | | - "export", |
23 | | - "import", |
24 | | - "internal" |
25 | | - ] |
| 16 | + "misp-attribute": "text", |
| 17 | + "ui-priority": 0 |
26 | 18 | }, |
27 | | - "is-thunk": { |
28 | | - "description": "identifies a thunk function", |
29 | | - "misp-attribute": "boolean", |
30 | | - "ui-priority": 0, |
31 | | - "disable_correlation": true |
| 19 | + "decompiled-function": { |
| 20 | + "description": "Ghidra decompiled function", |
| 21 | + "disable_correlation": true, |
| 22 | + "misp-attribute": "text", |
| 23 | + "ui-priority": 0 |
32 | 24 | }, |
33 | | - "external-library": { |
34 | | - "description": "external library name if the function is an import", |
| 25 | + "decompiler-id": { |
| 26 | + "description": "ghidra's decompiler version used to generate the FID and BSIM hashes.", |
| 27 | + "disable_correlation": true, |
35 | 28 | "misp-attribute": "text", |
36 | | - "ui-priority": 0, |
37 | | - "disable_correlation": true |
| 29 | + "ui-priority": 0 |
38 | 30 | }, |
39 | 31 | "entrypoint-address": { |
40 | 32 | "description": "function entrypoint address (integer in a text for consistency with the entrypoint-address in ELF/PE/Mach-O Objects)", |
41 | | - "misp-attribute": "text", |
42 | | - "ui-priority": 0, |
43 | | - "disable_correlation": true |
44 | | - }, |
45 | | - "instruction-count": { |
46 | | - "description": "Instruction count", |
47 | | - "misp-attribute": "integer", |
48 | | - "ui-priority": 0, |
49 | | - "disable_correlation": true |
50 | | - }, |
51 | | - "bsim-vector": { |
52 | | - "description": "comma separated BSIM Feature Vector", |
| 33 | + "disable_correlation": true, |
53 | 34 | "misp-attribute": "text", |
54 | 35 | "ui-priority": 0 |
55 | 36 | }, |
56 | | - "bsim-signature": { |
57 | | - "description": "BSIM signature of the vector", |
58 | | - "misp-attribute": "hex", |
| 37 | + "external-library": { |
| 38 | + "description": "external library name if the function is an import", |
| 39 | + "disable_correlation": true, |
| 40 | + "misp-attribute": "text", |
59 | 41 | "ui-priority": 0 |
60 | 42 | }, |
61 | 43 | "fid-fh-hash": { |
|
73 | 55 | "misp-attribute": "hex", |
74 | 56 | "ui-priority": 0 |
75 | 57 | }, |
76 | | - "decompiled-function": { |
77 | | - "description": "Ghidra decompiled function", |
| 58 | + "function-name": { |
| 59 | + "description": "function name", |
| 60 | + "disable_correlation": true, |
| 61 | + "misp-attribute": "text", |
| 62 | + "ui-priority": 1 |
| 63 | + }, |
| 64 | + "function-scope": { |
| 65 | + "description": "ghidra function scope (export, import, internal)", |
| 66 | + "disable_correlation": true, |
78 | 67 | "misp-attribute": "text", |
79 | | - "ui-priority": 0, |
80 | | - "disable_correlation": true |
| 68 | + "sane_default": [ |
| 69 | + "export", |
| 70 | + "import", |
| 71 | + "internal" |
| 72 | + ], |
| 73 | + "ui-priority": 0 |
81 | 74 | }, |
82 | 75 | "function-signature": { |
83 | 76 | "description": "Function signature", |
| 77 | + "disable_correlation": true, |
84 | 78 | "misp-attribute": "text", |
85 | | - "ui-priority": 0, |
86 | | - "disable_correlation": true |
| 79 | + "ui-priority": 0 |
87 | 80 | }, |
88 | | - "return-type": { |
89 | | - "description": "The data type returned by the function", |
90 | | - "misp-attribute": "text", |
91 | | - "ui-priority": 0, |
92 | | - "disable_correlation": true |
| 81 | + "instruction-count": { |
| 82 | + "description": "Instruction count", |
| 83 | + "disable_correlation": true, |
| 84 | + "misp-attribute": "integer", |
| 85 | + "ui-priority": 0 |
93 | 86 | }, |
94 | | - "calling-convention": { |
95 | | - "description": "The calling convention used by the function (e.g., cdecl, stdcall)", |
| 87 | + "is-thunk": { |
| 88 | + "description": "identifies a thunk function", |
| 89 | + "disable_correlation": true, |
| 90 | + "misp-attribute": "boolean", |
| 91 | + "ui-priority": 0 |
| 92 | + }, |
| 93 | + "label": { |
| 94 | + "description": "ghidra symbol label(s) associated with the function", |
| 95 | + "disable_correlation": true, |
96 | 96 | "misp-attribute": "text", |
97 | | - "ui-priority": 0, |
98 | | - "disable_correlation": true |
| 97 | + "multiple": true, |
| 98 | + "ui-priority": 0 |
99 | 99 | }, |
100 | | - "language-id": { |
| 100 | + "language-id": { |
101 | 101 | "description": "Language id of the program (architecture, compiler, etc.)", |
| 102 | + "disable_correlation": true, |
102 | 103 | "misp-attribute": "text", |
103 | | - "ui-priority": 0, |
104 | | - "disable_correlation": true |
| 104 | + "ui-priority": 0 |
105 | 105 | }, |
106 | | - "decompiler-id": { |
107 | | - "description": "ghidra's decompiler version used to generate the FID and BSIM hashes.", |
| 106 | + "return-type": { |
| 107 | + "description": "The data type returned by the function", |
| 108 | + "disable_correlation": true, |
108 | 109 | "misp-attribute": "text", |
109 | | - "ui-priority": 0, |
110 | | - "disable_correlation": true |
| 110 | + "ui-priority": 0 |
111 | 111 | } |
112 | 112 | }, |
113 | 113 | "description": "ghidra function", |
114 | | - "meta-category": "ghidra", |
| 114 | + "meta-category": "misc", |
115 | 115 | "name": "ghidra-function", |
116 | 116 | "required": [ |
117 | 117 | "function-name", |
|
0 commit comments