예제 #1
0
static int r_cmd_yara_scan(const RCore* core) {
    RListIter* rules_it;
    YR_RULES* rules;
    void* to_scan;
    int result;
    const unsigned int to_scan_size = r_io_size (core->io);

    if (to_scan_size < 1) {
        eprintf ("Invalid file size\n");
        return R_FALSE;
    }

    to_scan = malloc (to_scan_size);
    if (!to_scan) {
        eprintf ("Something went wrong during memory allocation\n");
        return R_FALSE;
    }

    result = r_io_read_at (core->io, 0L, to_scan, to_scan_size);
    if (!result) {
        eprintf ("Something went wrong during r_io_read_at\n");
        free (to_scan);
        return R_FALSE;
    }

    r_list_foreach (rules_list, rules_it, rules) {
        yr_rules_scan_mem (rules, to_scan, to_scan_size, 0, callback, NULL, 0);
    }
예제 #2
0
const_matches Yara::scan_bytes(const std::vector<boost::uint8_t>& bytes) const
{
	pcallback_data cb_data(new callback_data);
	cb_data->yara_matches = boost::make_shared<match_vector>();
	int retval;
	if (_rules == nullptr || bytes.size() == 0)
	{
		if (_rules == nullptr) {
			PRINT_ERROR << "No Yara rules loaded!" << std::endl;
		}
		return cb_data->yara_matches;
	}

	// Make a copy of the input buffer, because we can't be sure that Yara will not modify it
	// and the constness of the input has to be guaranteed.
	std::vector<boost::uint8_t> copy(bytes.begin(), bytes.end());

	// Yara setup done. Scan the file.
	retval = yr_rules_scan_mem(_rules,
							   &copy[0],		// The bytes to scan
							   bytes.size(),	// Number of bytes
                               SCAN_FLAGS_PROCESS_MEMORY,
							   get_match_data,
							   &cb_data,			// The vector to fill
							   0);				// No timeout)

	if (retval != ERROR_SUCCESS)
	{
		PRINT_ERROR << "Yara error: " << translate_error(retval) << std::endl;
		cb_data->yara_matches->clear();
	}

	return cb_data->yara_matches;
}
예제 #3
0
파일: rules.c 프로젝트: dodng/yara
int yr_rules_scan_file(
    YR_RULES* rules,
    const char* filename,
    YR_CALLBACK_FUNC callback,
    void* user_data,
    int fast_scan_mode,
    int timeout)
{
  MAPPED_FILE mfile;
  int result;

  result = yr_filemap_map(filename, &mfile);

  if (result == ERROR_SUCCESS)
  {
    result = yr_rules_scan_mem(
        rules,
        mfile.data,
        mfile.size,
        callback,
        user_data,
        fast_scan_mode,
        timeout);

    yr_filemap_unmap(&mfile);
  }

  return result;
}
예제 #4
0
파일: util.c 프로젝트: nsxz/yara
int matches_blob(
    char* rule,
    uint8_t* blob,
    size_t len)
{
  if (blob == NULL)
  {
    blob = (uint8_t*) "dummy";
    len = 5;
  }

  YR_RULES* rules = compile_rule(rule);

  if (rules == NULL)
  {
    fprintf(stderr, "failed to compile rule << %s >>: %s\n", rule, compile_error);
    exit(EXIT_FAILURE);
  }

  int matches = 0;
  int scan_result = yr_rules_scan_mem(
      rules, blob, len, 0, count_matches, &matches, 0);

  if (scan_result != ERROR_SUCCESS)
  {
    fprintf(stderr, "yr_rules_scan_mem: error\n");
    exit(EXIT_FAILURE);
  }

  yr_rules_destroy(rules);

  return matches;
}
예제 #5
0
        if (error == ERROR_CALLBACK_ERROR)
          return NULL;
        else
          return handle_error(error, filepath);
      }
    }
    else if (data != NULL)
    {
      callback_data.matches = PyList_New(0);

      Py_BEGIN_ALLOW_THREADS

      error = yr_rules_scan_mem(
          object->rules,
          (unsigned char*) data,
          (unsigned int) length,
          yara_callback,
          &callback_data,
          fast_mode,
          timeout);

      Py_END_ALLOW_THREADS

      if (error != ERROR_SUCCESS)
      {
        Py_DECREF(callback_data.matches);

        if (error == ERROR_CALLBACK_ERROR)
          return NULL;
        else
          return handle_error(error, NULL);
      }
예제 #6
0
static
RU32
    _scanProcessWith
    (
        RU32 pid,
        YaraMatchContext* matchContext,
        YR_RULES* rules,
        rEvent isTimeToStop
    )
{
    RU32 scanError = (RU32)(-1);
    rList modules = NULL;
    rSequence module = NULL;
    _MemRange* memRanges = NULL;
    RU32 i = 0;
    rList memoryMap = NULL;
    rSequence memoryRegion = NULL;
    RU8 memAccess = 0;
    RU64 mem = 0;
    RU64 memSize = 0;
    RPU8 buffer = NULL;

    // First pass is to scan known modules
    if( NULL != ( modules = processLib_getProcessModules( pid ) ) )
    {
        rpal_debug_info( "scanning process %d module memory with yara", pid );

        // We also generate an optimized list of module ranges for later
        if( NULL != ( memRanges = rpal_memory_alloc( sizeof( _MemRange ) *
                                                     rList_getNumElements( modules ) ) ) )
        {
            while( ( NULL == isTimeToStop || !rEvent_wait( isTimeToStop, MSEC_FROM_SEC( 5 ) ) ) &&
                   rList_getSEQUENCE( modules, RP_TAGS_DLL, &module ) )
            {
                if( rSequence_getPOINTER64( module, RP_TAGS_BASE_ADDRESS, &mem ) &&
                    rSequence_getRU64( module, RP_TAGS_MEMORY_SIZE, &memSize ) )
                {
                    memRanges[ i ].base = mem;
                    memRanges[ i ].size = memSize;
                    i++;

                    matchContext->regionBase = mem;
                    matchContext->regionSize = memSize;
                    matchContext->moduleInfo = module;

                    if( processLib_getProcessMemory( pid,
                                                     (RPVOID)NUMBER_TO_PTR( mem ),
                                                     memSize,
                                                     (RPVOID*)&buffer,
                                                     TRUE ) )
                    {
                        rpal_debug_info( "yara scanning module region of size 0x%lx", memSize );

                        if( NULL != rules ||
                            rMutex_lock( g_global_rules_mutex ) )
                        {
                            if( ERROR_SUCCESS != ( scanError = yr_rules_scan_mem( NULL == rules ? g_global_rules : rules,
                                                                                  buffer,
                                                                                  (size_t)memSize,
                                                                                  SCAN_FLAGS_FAST_MODE |
                                                                                  SCAN_FLAGS_PROCESS_MEMORY,
                                                                                  _yaraMemMatchCallback,
                                                                                  matchContext,
                                                                                  60 ) ) )
                            {
                                rpal_debug_warning( "Yara module scan error: %d 0x%lx 0x%lx: %d",
                                                    pid,
                                                    mem,
                                                    memSize,
                                                    scanError );
                            }

                            if( NULL == rules )
                            {
                                rMutex_unlock( g_global_rules_mutex );
                            }
                        }

                        rpal_memory_free( buffer );

                        rpal_debug_info( "finished region" );
                    }
                }
            }
        }

        rList_free( modules );
    }

    // Optimize the memory ranges
    if( rpal_memory_isValid( memRanges ) &&
        !rpal_sort_array( memRanges, i, sizeof( _MemRange ), (rpal_ordering_func)rpal_order_RU64 ) )
    {
        rpal_memory_free( memRanges );
        memRanges = NULL;
    }

    // Second pass is to go through executable non-module areas
    if( NULL != ( memoryMap = processLib_getProcessMemoryMap( pid ) ) )
    {
        rpal_debug_info( "scanning process %d non-module memory with yara", pid );

        while( ( NULL == isTimeToStop || !rEvent_wait(isTimeToStop, MSEC_FROM_SEC( 5 ) ) ) &&
               rList_getSEQUENCE( memoryMap, RP_TAGS_MEMORY_REGION, &memoryRegion ) )
        {
            if( rSequence_getPOINTER64( memoryRegion, RP_TAGS_BASE_ADDRESS, &mem ) &&
                rSequence_getRU64( memoryRegion, RP_TAGS_MEMORY_SIZE, &memSize ) &&
                rSequence_getRU8( memoryRegion, RP_TAGS_MEMORY_ACCESS, &memAccess ) &&
                ( PROCESSLIB_MEM_ACCESS_EXECUTE == memAccess ||
                  PROCESSLIB_MEM_ACCESS_EXECUTE_READ == memAccess ||
                  PROCESSLIB_MEM_ACCESS_EXECUTE_READ_WRITE == memAccess ||
                  PROCESSLIB_MEM_ACCESS_EXECUTE_WRITE_COPY  == memAccess ) )
            {
                // If it's in a known module, skip
                if( (RU32)( -1 ) != rpal_binsearch_array_closest( memRanges,
                                                                  i,
                                                                  sizeof( _MemRange ),
                                                                  &mem,
                                                                  (rpal_ordering_func)rpal_order_RU64,
                                                                  TRUE ) )
                {
                    continue;
                }
                matchContext->regionBase = mem;
                matchContext->regionSize = memSize;
                matchContext->moduleInfo = NULL;

                if( processLib_getProcessMemory( pid,
                                                 (RPVOID)NUMBER_TO_PTR(mem),
                                                 memSize,
                                                 (RPVOID*)&buffer,
                                                 TRUE ) )
                {
                    rpal_debug_info( "yara scanning memory region of size 0x%lx", memSize );

                    if( NULL != rules ||
                        rMutex_lock( g_global_rules_mutex ) )
                    {
                        if( ERROR_SUCCESS != ( scanError = yr_rules_scan_mem( NULL == rules ? g_global_rules : rules,
                                                                              buffer,
                                                                              (size_t)memSize,
                                                                              SCAN_FLAGS_FAST_MODE |
                                                                              SCAN_FLAGS_PROCESS_MEMORY,
                                                                              _yaraMemMatchCallback,
                                                                              matchContext,
                                                                              60 ) ) )
                        {
                            rpal_debug_warning( "Yara memory scan error: %d 0x%lx 0x%lx: %d",
                                                pid,
                                                mem,
                                                memSize,
                                                scanError );
                        }

                        if( NULL == rules )
                        {
                            rMutex_unlock( g_global_rules_mutex );
                        }
                    }

                    rpal_memory_free( buffer );
                }
            }
        }

        rList_free( memoryMap );
    }

    if( rpal_memory_isValid( memRanges ) )
    {
        rpal_memory_free( memRanges );
    }

    return scanError;
}
예제 #7
0
파일: yara.c 프로젝트: Amelos/moloch
void  moloch_yara_email_execute(MolochSession_t *session, unsigned char *data, int len, int UNUSED(first))
{
    yr_rules_scan_mem(yEmailRules, data, len, 0, (YR_CALLBACK_FUNC)moloch_yara_callback, session, 0);
    return;
}