From 7c2ac2d05cbda173e71e036f224a1a27770047b7 Mon Sep 17 00:00:00 2001
From: mr-tz <moritz.raabe@mandiant.com>
Date: Sun, 27 Aug 2023 19:55:41 +0200
Subject: [PATCH] add rule

---
 nursery/send-sms-on-android.yml | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 nursery/send-sms-on-android.yml

diff --git a/nursery/send-sms-on-android.yml b/nursery/send-sms-on-android.yml
new file mode 100644
index 000000000..825432752
--- /dev/null
+++ b/nursery/send-sms-on-android.yml
@@ -0,0 +1,24 @@
+rule:
+  meta:
+    name: send SMS on Android
+    namespace: communication/sms
+    authors:
+      - "@mr-tz"
+    scope: function
+    # att&ck:
+    #   - Mobile::SMS Control [T1582]
+  features:
+    - and:
+      - os: android
+      # ... = (*env)->FindClass(env, "android/telephony/SmsManager");
+      - string: "android/telephony/SmsManager"
+      - optional:
+        - or:
+          - and:
+            - arch: i386
+            - offset: 0x30 = (*env)->FindClass
+          - and:
+            - arch: amd64
+            - offset: 0x1C = (*env)->FindClass
+      # ... = (*env)->GetMethodID(env, ..., "sendTextMessage" ...);
+      - string: "sendTextMessage"