mirror of
https://github.com/mandiant/capa.git
synced 2025-12-12 15:49:46 -08:00
linter: skip native API check for more UEFI routines
This commit is contained in:
@@ -571,6 +571,8 @@ class FeatureNtdllNtoskrnlApi(Lint):
|
||||
"RtlCreateUserProcess",
|
||||
"NtProtectVirtualMemory",
|
||||
"NtEnumerateSystemEnvironmentValuesEx",
|
||||
"NtQuerySystemEnvironmentValueEx",
|
||||
"NtQuerySystemEnvironmentValue",
|
||||
):
|
||||
# ntoskrnl.exe does not export these routines
|
||||
continue
|
||||
@@ -581,6 +583,7 @@ class FeatureNtdllNtoskrnlApi(Lint):
|
||||
"KeStackAttachProcess",
|
||||
"ObfDereferenceObject",
|
||||
"KeUnstackDetachProcess",
|
||||
"ExGetFirmwareEnvironmentVariable",
|
||||
):
|
||||
# ntdll.dll does not export these routines
|
||||
continue
|
||||
|
||||
Reference in New Issue
Block a user