diff --git a/objects/elf-section/definition.json b/objects/elf-section/definition.json index 19a8642..e8b031b 100644 --- a/objects/elf-section/definition.json +++ b/objects/elf-section/definition.json @@ -4,12 +4,12 @@ "description": "Object describing a section of an Executable and Linkable Format", "version": 1, "attributes": { - "name": { + "sh_name": { "misp-attribute": "text", "misp-usage-frequency": 1, "disable_correlation": true }, - "Flags": { + "sh_flags": { "misp-attribute": "text", "misp-usage-frequency": 0, "sane_default": [ @@ -36,7 +36,7 @@ "misp-usage-frequency": 1, "disable_correlation": true }, - "size-in-bytes": { + "sh_size": { "misp-attribute": "size-in-bytes", "misp-usage-frequency": 1, "disable_correlation": true diff --git a/objects/elf/definition.json b/objects/elf/definition.json index a539f59..06454eb 100644 --- a/objects/elf/definition.json +++ b/objects/elf/definition.json @@ -13,7 +13,7 @@ "misp-attribute": "filename", "misp-usage-frequency": 1 }, - "entrypoint-address": { + "e_entry": { "misp-attribute": "text", "misp-usage-frequency": 0, "disable_correlation": true @@ -23,17 +23,61 @@ "misp-usage-frequency": 0, "disable_correlation": true }, - "file-version": { + "e_version": { "misp-attribute": "text", "misp-usage-frequency": 0, "disable_correlation": true }, - "elf-type": { + "e_type":{ "misp-attribute": "text", - "misp-usage-frequency": 0, - "disable_correlation": true - } + "misp-usage-frequency": 0, + "sane_default":[ + "relocatable", + "executable", + "shared", + "core" + ] + }, + "e_ident_abi":{ + "misp-attribute": "text", + "misp-usage-frequency": 0, + "sane_default":[ + "System V", + "HP_UX", + "NetBSD", + "Linux", + "Solaris", + "AIX", + "IRIX", + "FreeBSD", + "True64", + "Novell Modesto", + "OpenBSD", + "OpenVMS", + "NonStop Kernel", + "AROS", + "Fenis OS", + "CloudABI", + "Sortix" + ]}, + "e_machine":{ + "misp-attribute": "text", + "misp-usage-frequency": 0, + "sane_default":[ + "No specific instruction set", + "SPARC", + "X86", + "MISP", + "PowerPC", + "ARM", + "SuperH", + "IA-64", + "x86-64", + "AArch64", + "RISC-V" + ]} }, + "requiredOneOf": [ "text", "original-filename",