Repository navigation
check heap flags #1187
Description
we have rules for fetching the heap flags, but not how they are interpreted.
here's a reference: https://www.reverseengineering.app/en/techniques/heap-flags
5e17360d32e9b272bb7e1b97c8e4dca34622ec9ce08fd240fe2758cc3f67dc4a:0x1400016FB does this:
Activity
Pratham21223 commentedon Oct 18, 2026
Hi @williballenthin! I'd like to work on this issue.
From my understanding, the existing rules detect fetching heap flags, but we're missing a rule for detecting how those flags are interpreted.
I'll investigate the referenced PATCHCORD instruction sequence, identify the relevant flag-checking pattern, and look into adding a rule that detects this behavior without duplicating the existing rules.