From 97e07f9ae92edee77004d7a561efc45c6d673fda Mon Sep 17 00:00:00 2001
From: Caroline Russell <caroline@appthreat.dev>
Date: Tue, 13 Jun 2023 02:42:56 -0400
Subject: [PATCH 1/2] initial commit

---
 blint/data/annotations/review_monero_go.yml | 65 +++++++++++++++++++++
 1 file changed, 65 insertions(+)
 create mode 100644 blint/data/annotations/review_monero_go.yml

diff --git a/blint/data/annotations/review_monero_go.yml b/blint/data/annotations/review_monero_go.yml
new file mode 100644
index 0000000..d5462d0
--- /dev/null
+++ b/blint/data/annotations/review_monero_go.yml
@@ -0,0 +1,65 @@
+---
+text: Review for Monero identified in a binary produced by Go build
+group: SYMBOL_REVIEWS
+exe_type: 
+  - gobinary
+  - x86_64-executable
+rules:
+  - id: MONERO_API_GO
+    title: Detect use of Monero wallet
+    summary: 
+    description: |
+      Monero is a cryptocurrency focused on private and censorship-resistant transactions.
+    patterns:
+      - AddAddressBook
+      - ChangeWalletPassword
+      - CheckReserveProof
+      - CheckSpendProof
+      - CheckTxKey
+      - CheckTxProof
+      - CloseWallet
+      - CreateWallet
+      - DeleteAddressBook
+      - ErrDaemonIsBusy
+      - ErrWrongKeyImage
+      - ErrWrongPaymentID
+      - ErrWrongTxID
+      - ExportKeyImages
+      - ExportMultisigInfo
+      - FinalizeMultisig
+      - Float64ToXMR
+      - GenerateFromKeys
+      - GetBalance
+      - GetBulkPayments
+      - GetPayments
+      - GetReserveProof
+      - GetSpendProof
+      - GetTransferByTxID
+      - GetTransfers
+      - GetTxKey
+      - GetTxNotes
+      - GetTxProof
+      - ImportKeyImages
+      - ImportMultisigInfo
+      - IncomingTransfers
+      - MakeIntegratedAddress
+      - MakeMultisig
+      - NewPaymentID256
+      - NewPaymentID64
+      - OpenWallet
+      - PrepareMultisig
+      - RelayTx
+      - RescanBlockchain
+      - RescanSpent
+      - SetTxNotes
+      - SignTransfer
+      - SplitIntegratedAddress
+      - StartMining
+      - StopMining
+      - StopWallet
+      - StringToXMR
+      - SubmitMultisig
+      - SubmitTransfer
+      - TransferSplit
+      - XMRToDecimal
+      - XMRToFloat64

From 05eb9bc3d33fd01fd14fa5fde0503122198ff7cf Mon Sep 17 00:00:00 2001
From: Caroline Russell <caroline@appthreat.dev>
Date: Tue, 13 Jun 2023 02:44:39 -0400
Subject: [PATCH 2/2] initial commit

---
 blint/data/annotations/review_monero_rust | 31 +++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 blint/data/annotations/review_monero_rust

diff --git a/blint/data/annotations/review_monero_rust b/blint/data/annotations/review_monero_rust
new file mode 100644
index 0000000..ac795f3
--- /dev/null
+++ b/blint/data/annotations/review_monero_rust
@@ -0,0 +1,31 @@
+---
+text: Review for Monero identified in a binary produced by cargo build
+group: SYMBOL_REVIEWS
+exe_type: genericbinary
+rules:
+  - id: MONERO_API_RUST
+    title: Detect monero API
+    summary: 
+    description: |
+      Monero is a cryptocurrency focused on private and censorship-resistant transactions.
+    patterns:
+      - blockdata::block::Block
+      - blockdata::block::BlockHeader
+      - blockdata::transaction::OwnedTxOut
+      - blockdata::transaction::Transaction
+      - blockdata::transaction::TransactionPrefix
+      - blockdata::transaction::TxIn
+      - blockdata::transaction::TxOut
+      - consensus_encode
+      - consensus_decode
+      - cryptonote::hash::Hash
+      - monero::blockdata::transaction::Transaction
+      - monero::consensus::encode::deserialize
+      - monero::util::key
+      - Network::Mainnet
+      - Network::Stagenet
+      - util::amount::SignedAmount
+      - MONERO_MUL_FACTOR
+      - consensus::encode::Encodable
+      - TxOutTarget
+      - tx_pubkey