{"action":"created","comment":{"url":"https://api.github.com/repos/rednaga/APKiD/pulls/comments/236829974","pull_request_review_id":178988532,"id":236829974,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDIzNjgyOTk3NA==","diff_hunk":"@@ -215,3 +215,42 @@ rule avdobfuscator : obfuscator\n     any of them and is_elf\n }\n \n+rule arxan_native_arm : obfuscator\n+{\n+    meta:\n+        description = \"Arxan\"\n+        url         = \"https://www.arxan.com/resources/technology/app-code-obfuscation\"\n+        sample      = \"5bbb241d41c4150798b5800e62afcb6f49e05755d2fd89c7a9f7e356609c9012\"\n+        author      = \"Eduardo Novella\"\n+\n+    strings:\n+        $a = {\n+            00 10 90 E5    // LDR R1, [R0]\n+            00 00 81 E0    // ADD R0, R1, R0\n+            03 10 00 E0    // AND R1, R0, R3\n+            02 20 A0 E3    // MOV R2, #2\n+            92 01 01 E0    // MUL R1, R2, R1\n+            03 00 20 E0    // EOR R0, R0, R3\n+            01 00 80 E0    // ADD R0, R0, R1\n+            00 F0 A0 E1    // MOV PC, R0\n+        }\n+\n+        $b = {\n+            4F F0 01 00    // MOV.W   R0, #1\n+            02 A1          // ADR     R1, loc_191658\n+            01 FB 00 F0    // MUL.W   R0, R1, R0\n+            87 46          // MOV     PC, R0\n+        }\n+\n+        $c = {\n+            ?? ?? ?? E?\n+            91 00 00 E0    // MUL     R0, R1, R0\n+            00 F0 A0 E1    // MOV     PC, R0\n+        }\n+\n+    condition:\n+        // TODO: Count occurrences and > 20 times //(for 10 i in (1..#a): (@a[i] >= 50 and @a[i] <= 100))\n+        // TODO: ARM64 & X86\n+        ($a or $b or $c) and elf.machine == elf.EM_ARM","path":"apkid/rules/elf/obfuscators.yara","position":null,"original_position":40,"commit_id":"5d43de9f68822d646cf1badb8e4df0a76d9c189c","original_commit_id":"49c68220ab8e28d8db0aa6711e273f02a02520ac","user":{"login":"enovella","id":14809754,"node_id":"MDQ6VXNlcjE0ODA5NzU0","avatar_url":"https://avatars3.githubusercontent.com/u/14809754?v=4","gravatar_id":"","url":"https://api.github.com/users/enovella","html_url":"https://github.com/enovella","followers_url":"https://api.github.com/users/enovella/followers","following_url":"https://api.github.com/users/enovella/following{/other_user}","gists_url":"https://api.github.com/users/enovella/gists{/gist_id}","starred_url":"https://api.github.com/users/enovella/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/enovella/subscriptions","organizations_url":"https://api.github.com/users/enovella/orgs","repos_url":"https://api.github.com/users/enovella/repos","events_url":"https://api.github.com/users/enovella/events{/privacy}","received_events_url":"https://api.github.com/users/enovella/received_events","type":"User","site_admin":false},"body":"why not? Of course yes.... So many things going on and sometimes miss comments","created_at":"2018-11-27T20:16:39Z","updated_at":"2018-11-27T20:16:39Z","html_url":"https://github.com/rednaga/APKiD/pull/128#discussion_r236829974","pull_request_url":"https://api.github.com/repos/rednaga/APKiD/pulls/128","author_association":"COLLABORATOR","_links":{"self":{"href":"https://api.github.com/repos/rednaga/APKiD/pulls/comments/236829974"},"html":{"href":"https://github.com/rednaga/APKiD/pull/128#discussion_r236829974"},"pull_request":{"href":"https://api.github.com/repos/rednaga/APKiD/pulls/128"}},"in_reply_to_id":236346225},"pull_request":{"url":"https://api.github.com/repos/rednaga/APKiD/pulls/128","id":233294695,"node_id":"MDExOlB1bGxSZXF1ZXN0MjMzMjk0Njk1","html_url":"https://github.com/rednaga/APKiD/pull/128","diff_url":"https://github.com/rednaga/APKiD/pull/128.diff","patch_url":"https://github.com/rednaga/APKiD/pull/128.patch","issue_url":"https://api.github.com/repos/rednaga/APKiD/issues/128","number":128,"state":"closed","locked":false,"title":"BH eu2018: Arxan native obfuscator (arm32 only)","user":{"login":"enovella","id":14809754,"node_id":"MDQ6VXNlcjE0ODA5NzU0","avatar_url":"https://avatars3.githubusercontent.com/u/14809754?v=4","gravatar_id":"","url":"https://api.github.com/users/enovella","html_url":"https://github.com/enovella","followers_url":"https://api.github.com/users/enovella/followers","following_url":"https://api.github.com/users/enovella/following{/other_user}","gists_url":"https://api.github.com/users/enovella/gists{/gist_id}","starred_url":"https://api.github.com/users/enovella/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/enovella/subscriptions","organizations_url":"https://api.github.com/users/enovella/orgs","repos_url":"https://api.github.com/users/enovella/repos","events_url":"https://api.github.com/users/enovella/events{/privacy}","received_events_url":"https://api.github.com/users/enovella/received_events","type":"User","site_admin":false},"body":"Issue https://github.com/rednaga/APKiD/issues/120","created_at":"2018-11-24T01:31:35Z","updated_at":"2018-11-27T20:16:39Z","closed_at":"2018-11-27T18:38:24Z","merged_at":"2018-11-27T18:38:23Z","merge_commit_sha":"969a8ea80d75dfdec011af3423fbeee58332ca40","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/rednaga/APKiD/pulls/128/commits","review_comments_url":"https://api.github.com/repos/rednaga/APKiD/pulls/128/comments","review_comment_url":"https://api.github.com/repos/rednaga/APKiD/pulls/comments{/number}","comments_url":"https://api.github.com/repos/rednaga/APKiD/issues/128/comments","statuses_url":"https://api.github.com/repos/rednaga/APKiD/statuses/5d43de9f68822d646cf1badb8e4df0a76d9c189c","head":{"label":"enovella:arxan_native","ref":"arxan_native","sha":"5d43de9f68822d646cf1badb8e4df0a76d9c189c","user":{"login":"enovella","id":14809754,"node_id":"MDQ6VXNlcjE0ODA5NzU0","avatar_url":"https://avatars3.githubusercontent.com/u/14809754?v=4","gravatar_id":"","url":"https://api.github.com/users/enovella","html_url":"https://github.com/enovella","followers_url":"https://api.github.com/users/enovella/followers","following_url":"https://api.github.com/users/enovella/following{/other_user}","gists_url":"https://api.github.com/users/enovella/gists{/gist_id}","starred_url":"https://api.github.com/users/enovella/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/enovella/subscriptions","organizations_url":"https://api.github.com/users/enovella/orgs","repos_url":"https://api.github.com/users/enovella/repos","events_url":"https://api.github.com/users/enovella/events{/privacy}","received_events_url":"https://api.github.com/users/enovella/received_events","type":"User","site_admin":false},"repo":{"id":108183307,"node_id":"MDEwOlJlcG9zaXRvcnkxMDgxODMzMDc=","name":"APKiD","full_name":"enovella/APKiD","private":false,"owner":{"login":"enovella","id":14809754,"node_id":"MDQ6VXNlcjE0ODA5NzU0","avatar_url":"https://avatars3.githubusercontent.com/u/14809754?v=4","gravatar_id":"","url":"https://api.github.com/users/enovella","html_url":"https://github.com/enovella","followers_url":"https://api.github.com/users/enovella/followers","following_url":"https://api.github.com/users/enovella/following{/other_user}","gists_url":"https://api.github.com/users/enovella/gists{/gist_id}","starred_url":"https://api.github.com/users/enovella/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/enovella/subscriptions","organizations_url":"https://api.github.com/users/enovella/orgs","repos_url":"https://api.github.com/users/enovella/repos","events_url":"https://api.github.com/users/enovella/events{/privacy}","received_events_url":"https://api.github.com/users/enovella/received_events","type":"User","site_admin":false},"html_url":"https://github.com/enovella/APKiD","description":"Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android","fork":true,"url":"https://api.github.com/repos/enovella/APKiD","forks_url":"https://api.github.com/repos/enovella/APKiD/forks","keys_url":"https://api.github.com/repos/enovella/APKiD/keys{/key_id}","collaborators_url":"https://api.github.com/repos/enovella/APKiD/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/enovella/APKiD/teams","hooks_url":"https://api.github.com/repos/enovella/APKiD/hooks","issue_events_url":"https://api.github.com/repos/enovella/APKiD/issues/events{/number}","events_url":"https://api.github.com/repos/enovella/APKiD/events","assignees_url":"https://api.github.com/repos/enovella/APKiD/assignees{/user}","branches_url":"https://api.github.com/repos/enovella/APKiD/branches{/branch}","tags_url":"https://api.github.com/repos/enovella/APKiD/tags","blobs_url":"https://api.github.com/repos/enovella/APKiD/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/enovella/APKiD/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/enovella/APKiD/git/refs{/sha}","trees_url":"https://api.github.com/repos/enovella/APKiD/git/trees{/sha}","statuses_url":"https://api.github.com/repos/enovella/APKiD/statuses/{sha}","languages_url":"https://api.github.com/repos/enovella/APKiD/languages","stargazers_url":"https://api.github.com/repos/enovella/APKiD/stargazers","contributors_url":"https://api.github.com/repos/enovella/APKiD/contributors","subscribers_url":"https://api.github.com/repos/enovella/APKiD/subscribers","subscription_url":"https://api.github.com/repos/enovella/APKiD/subscription","commits_url":"https://api.github.com/repos/enovella/APKiD/commits{/sha}","git_commits_url":"https://api.github.com/repos/enovella/APKiD/git/commits{/sha}","comments_url":"https://api.github.com/repos/enovella/APKiD/comments{/number}","issue_comment_url":"https://api.github.com/repos/enovella/APKiD/issues/comments{/number}","contents_url":"https://api.github.com/repos/enovella/APKiD/contents/{+path}","compare_url":"https://api.github.com/repos/enovella/APKiD/compare/{base}...{head}","merges_url":"https://api.github.com/repos/enovella/APKiD/merges","archive_url":"https://api.github.com/repos/enovella/APKiD/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/enovella/APKiD/downloads","issues_url":"https://api.github.com/repos/enovella/APKiD/issues{/number}","pulls_url":"https://api.github.com/repos/enovella/APKiD/pulls{/number}","milestones_url":"https://api.github.com/repos/enovella/APKiD/milestones{/number}","notifications_url":"https://api.github.com/repos/enovella/APKiD/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/enovella/APKiD/labels{/name}","releases_url":"https://api.github.com/repos/enovella/APKiD/releases{/id}","deployments_url":"https://api.github.com/repos/enovella/APKiD/deployments","created_at":"2017-10-24T21:02:09Z","updated_at":"2018-11-26T18:20:48Z","pushed_at":"2018-11-27T18:43:46Z","git_url":"git://github.com/enovella/APKiD.git","ssh_url":"git@github.com:enovella/APKiD.git","clone_url":"https://github.com/enovella/APKiD.git","svn_url":"https://github.com/enovella/APKiD","homepage":"","size":10003,"stargazers_count":1,"watchers_count":1,"language":"YARA","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":0,"open_issues":0,"watchers":1,"default_branch":"master"}},"base":{"label":"rednaga:master","ref":"master","sha":"737e2afc00362113b3402d10eb19749101943584","user":{"login":"rednaga","id":10507639,"node_id":"MDEyOk9yZ2FuaXphdGlvbjEwNTA3NjM5","avatar_url":"https://avatars3.githubusercontent.com/u/10507639?v=4","gravatar_id":"","url":"https://api.github.com/users/rednaga","html_url":"https://github.com/rednaga","followers_url":"https://api.github.com/users/rednaga/followers","following_url":"https://api.github.com/users/rednaga/following{/other_user}","gists_url":"https://api.github.com/users/rednaga/gists{/gist_id}","starred_url":"https://api.github.com/users/rednaga/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rednaga/subscriptions","organizations_url":"https://api.github.com/users/rednaga/orgs","repos_url":"https://api.github.com/users/rednaga/repos","events_url":"https://api.github.com/users/rednaga/events{/privacy}","received_events_url":"https://api.github.com/users/rednaga/received_events","type":"Organization","site_admin":false},"repo":{"id":61825895,"node_id":"MDEwOlJlcG9zaXRvcnk2MTgyNTg5NQ==","name":"APKiD","full_name":"rednaga/APKiD","private":false,"owner":{"login":"rednaga","id":10507639,"node_id":"MDEyOk9yZ2FuaXphdGlvbjEwNTA3NjM5","avatar_url":"https://avatars3.githubusercontent.com/u/10507639?v=4","gravatar_id":"","url":"https://api.github.com/users/rednaga","html_url":"https://github.com/rednaga","followers_url":"https://api.github.com/users/rednaga/followers","following_url":"https://api.github.com/users/rednaga/following{/other_user}","gists_url":"https://api.github.com/users/rednaga/gists{/gist_id}","starred_url":"https://api.github.com/users/rednaga/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rednaga/subscriptions","organizations_url":"https://api.github.com/users/rednaga/orgs","repos_url":"https://api.github.com/users/rednaga/repos","events_url":"https://api.github.com/users/rednaga/events{/privacy}","received_events_url":"https://api.github.com/users/rednaga/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/rednaga/APKiD","description":"Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android","fork":false,"url":"https://api.github.com/repos/rednaga/APKiD","forks_url":"https://api.github.com/repos/rednaga/APKiD/forks","keys_url":"https://api.github.com/repos/rednaga/APKiD/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rednaga/APKiD/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rednaga/APKiD/teams","hooks_url":"https://api.github.com/repos/rednaga/APKiD/hooks","issue_events_url":"https://api.github.com/repos/rednaga/APKiD/issues/events{/number}","events_url":"https://api.github.com/repos/rednaga/APKiD/events","assignees_url":"https://api.github.com/repos/rednaga/APKiD/assignees{/user}","branches_url":"https://api.github.com/repos/rednaga/APKiD/branches{/branch}","tags_url":"https://api.github.com/repos/rednaga/APKiD/tags","blobs_url":"https://api.github.com/repos/rednaga/APKiD/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rednaga/APKiD/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rednaga/APKiD/git/refs{/sha}","trees_url":"https://api.github.com/repos/rednaga/APKiD/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rednaga/APKiD/statuses/{sha}","languages_url":"https://api.github.com/repos/rednaga/APKiD/languages","stargazers_url":"https://api.github.com/repos/rednaga/APKiD/stargazers","contributors_url":"https://api.github.com/repos/rednaga/APKiD/contributors","subscribers_url":"https://api.github.com/repos/rednaga/APKiD/subscribers","subscription_url":"https://api.github.com/repos/rednaga/APKiD/subscription","commits_url":"https://api.github.com/repos/rednaga/APKiD/commits{/sha}","git_commits_url":"https://api.github.com/repos/rednaga/APKiD/git/commits{/sha}","comments_url":"https://api.github.com/repos/rednaga/APKiD/comments{/number}","issue_comment_url":"https://api.github.com/repos/rednaga/APKiD/issues/comments{/number}","contents_url":"https://api.github.com/repos/rednaga/APKiD/contents/{+path}","compare_url":"https://api.github.com/repos/rednaga/APKiD/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rednaga/APKiD/merges","archive_url":"https://api.github.com/repos/rednaga/APKiD/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rednaga/APKiD/downloads","issues_url":"https://api.github.com/repos/rednaga/APKiD/issues{/number}","pulls_url":"https://api.github.com/repos/rednaga/APKiD/pulls{/number}","milestones_url":"https://api.github.com/repos/rednaga/APKiD/milestones{/number}","notifications_url":"https://api.github.com/repos/rednaga/APKiD/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rednaga/APKiD/labels{/name}","releases_url":"https://api.github.com/repos/rednaga/APKiD/releases{/id}","deployments_url":"https://api.github.com/repos/rednaga/APKiD/deployments","created_at":"2016-06-23T18:00:21Z","updated_at":"2018-11-27T18:38:26Z","pushed_at":"2018-11-27T18:43:47Z","git_url":"git://github.com/rednaga/APKiD.git","ssh_url":"git@github.com:rednaga/APKiD.git","clone_url":"https://github.com/rednaga/APKiD.git","svn_url":"https://github.com/rednaga/APKiD","homepage":"","size":9935,"stargazers_count":439,"watchers_count":439,"language":"YARA","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":109,"mirror_url":null,"archived":false,"open_issues_count":35,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":109,"open_issues":35,"watchers":439,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/rednaga/APKiD/pulls/128"},"html":{"href":"https://github.com/rednaga/APKiD/pull/128"},"issue":{"href":"https://api.github.com/repos/rednaga/APKiD/issues/128"},"comments":{"href":"https://api.github.com/repos/rednaga/APKiD/issues/128/comments"},"review_comments":{"href":"https://api.github.com/repos/rednaga/APKiD/pulls/128/comments"},"review_comment":{"href":"https://api.github.com/repos/rednaga/APKiD/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/rednaga/APKiD/pulls/128/commits"},"statuses":{"href":"https://api.github.com/repos/rednaga/APKiD/statuses/5d43de9f68822d646cf1badb8e4df0a76d9c189c"}},"author_association":"COLLABORATOR"}}
{"actor":{"display_login":"enovella"}}