(CAPA) CAPA_localsize

June 20, 2022, midnight | 2 weeks, 2 days
            rule:
  meta:
    name: trap debugger with localsize
    namespace: anti-analysis/anti-debugging
    author: lordtmk@protonmail.com
    scope: basic block
    examples:
      - B67E5B1985742F62785122B637EF4FBD:0x4B1F5B
  features:
    - and:
      - api: LocalSize
      - mnemonic: push 
      - number: 0
        

Associated Techniques

Technique Name Technique ID's Has Snippet(s)
LocalSize(0) U0128

Comment