int yr_ac_automaton_create(
YR_AC_AUTOMATON** automaton)
{
YR_AC_AUTOMATON* new_automaton;
YR_AC_STATE* root_state;
new_automaton = (YR_AC_AUTOMATON*) yr_malloc(sizeof(YR_AC_AUTOMATON));
root_state = (YR_AC_STATE*) yr_malloc(sizeof(YR_AC_STATE));
if (new_automaton == NULL || root_state == NULL)
{
yr_free(new_automaton);
yr_free(root_state);
return ERROR_INSUFFICIENT_MEMORY;
}
root_state->depth = 0;
root_state->matches = NULL;
root_state->failure = NULL;
root_state->first_child = NULL;
root_state->siblings = NULL;
root_state->t_table_slot = 0;
new_automaton->root = root_state;
new_automaton->m_table = NULL;
new_automaton->t_table = NULL;
new_automaton->tables_size = 0;
*automaton = new_automaton;
return ERROR_SUCCESS;
}
int yr_re_finalize_thread(void)
{
RE_FIBER* fiber;
RE_FIBER* next_fiber;
RE_THREAD_STORAGE* storage;
if (thread_storage_key != 0)
storage = (RE_THREAD_STORAGE*) yr_thread_storage_get_value(
&thread_storage_key);
else
return ERROR_SUCCESS;
if (storage != NULL)
{
fiber = storage->fiber_pool.fibers.head;
while (fiber != NULL)
{
next_fiber = fiber->next;
yr_free(fiber);
fiber = next_fiber;
}
yr_free(storage);
}
return yr_thread_storage_set_value(&thread_storage_key, NULL);
}
void yr_arena_destroy(
YR_ARENA* arena)
{
YR_RELOC* reloc;
YR_RELOC* next_reloc;
YR_ARENA_PAGE* page;
YR_ARENA_PAGE* next_page;
if (arena == NULL)
return;
page = arena->page_list_head;
while(page != NULL)
{
next_page = page->next;
reloc = page->reloc_list_head;
while (reloc != NULL)
{
next_reloc = reloc->next;
yr_free(reloc);
reloc = next_reloc;
}
yr_free(page->address);
yr_free(page);
page = next_page;
}
yr_free(arena);
}
YR_API void yr_hash_table_clean(
YR_HASH_TABLE* table,
YR_HASH_TABLE_FREE_VALUE_FUNC free_value)
{
YR_HASH_TABLE_ENTRY* entry;
YR_HASH_TABLE_ENTRY* next_entry;
int i;
if (table == NULL)
return;
for (i = 0; i < table->size; i++)
{
entry = table->buckets[i];
while (entry != NULL)
{
next_entry = entry->next;
if (free_value != NULL)
free_value(entry->value);
if (entry->ns != NULL)
yr_free(entry->ns);
yr_free(entry->key);
yr_free(entry);
entry = next_entry;
}
table->buckets[i] = NULL;
}
}
int yr_rules_destroy(
YR_RULES* rules)
{
YR_EXTERNAL_VARIABLE* external;
external = rules->externals_list_head;
while (!EXTERNAL_VARIABLE_IS_NULL(external))
{
if (external->type == EXTERNAL_VARIABLE_TYPE_MALLOC_STRING)
yr_free(external->string);
external++;
}
#if WIN32
CloseHandle(rules->mutex);
#else
pthread_mutex_destroy(&rules->mutex);
#endif
yr_arena_destroy(rules->arena);
yr_free(rules);
return ERROR_SUCCESS;
}
int yr_re_finalize_thread()
{
RE_FIBER* fiber;
RE_FIBER* next_fiber;
RE_THREAD_STORAGE* storage;
#ifdef WIN32
storage = TlsGetValue(thread_storage_key);
#else
storage = pthread_getspecific(thread_storage_key);
#endif
if (storage != NULL)
{
fiber = storage->fiber_pool.head;
while (fiber != NULL)
{
next_fiber = fiber->next;
yr_free(fiber);
fiber = next_fiber;
}
yr_free(storage);
}
return ERROR_SUCCESS;
}
void yr_hash_table_destroy(
YR_HASH_TABLE* table)
{
YR_HASH_TABLE_ENTRY* entry;
YR_HASH_TABLE_ENTRY* next_entry;
int i;
for (i = 0; i < table->size; i++)
{
entry = table->buckets[i];
while (entry != NULL)
{
next_entry = entry->next;
if (entry->ns != NULL)
yr_free(entry->ns);
yr_free(entry->key);
yr_free(entry);
entry = next_entry;
}
}
yr_free(table);
}
YR_API int yr_hash_table_add_raw_key(
YR_HASH_TABLE* table,
const void* key,
size_t key_length,
const char* ns,
void* value)
{
YR_HASH_TABLE_ENTRY* entry;
uint32_t bucket_index;
entry = (YR_HASH_TABLE_ENTRY*) yr_malloc(sizeof(YR_HASH_TABLE_ENTRY));
if (entry == NULL)
return ERROR_INSUFICIENT_MEMORY;
entry->key = yr_malloc(key_length);
if (entry->key == NULL)
{
yr_free(entry);
return ERROR_INSUFICIENT_MEMORY;
}
if (ns != NULL)
{
entry->ns = yr_strdup(ns);
if (entry->ns == NULL)
{
yr_free(entry->key);
yr_free(entry);
return ERROR_INSUFICIENT_MEMORY;
}
}
else
{
entry->ns = NULL;
}
entry->key_length = key_length;
entry->value = value;
memcpy(entry->key, key, key_length);
bucket_index = hash(0, key, key_length);
if (ns != NULL)
bucket_index = hash(bucket_index, (uint8_t*) ns, strlen(ns));
bucket_index = bucket_index % table->size;
entry->next = table->buckets[bucket_index];
table->buckets[bucket_index] = entry;
return ERROR_SUCCESS;
}
void yr_object_destroy(
YR_OBJECT* object)
{
YR_STRUCTURE_MEMBER* member;
YR_STRUCTURE_MEMBER* next_member;
YR_ARRAY_ITEMS* array_items;
RE* re;
int i;
char* str;
switch(object->type)
{
case OBJECT_TYPE_STRUCTURE:
member = ((YR_OBJECT_STRUCTURE*) object)->members;
while (member != NULL)
{
next_member = member->next;
yr_object_destroy(member->object);
yr_free(member);
member = next_member;
}
break;
case OBJECT_TYPE_STRING:
str = ((YR_OBJECT_STRING*) object)->value;
if (str != NULL)
yr_free(str);
break;
case OBJECT_TYPE_REGEXP:
re = ((YR_OBJECT_REGEXP*) object)->value;
if (re != NULL)
yr_re_destroy(re);
break;
case OBJECT_TYPE_ARRAY:
array_items = ((YR_OBJECT_ARRAY*) object)->items;
for (i = 0; i < array_items->count; i++)
if (array_items->objects[i] != NULL)
yr_object_destroy(array_items->objects[i]);
yr_free(array_items);
break;
case OBJECT_TYPE_FUNCTION:
yr_object_destroy(((YR_OBJECT_FUNCTION*) object)->return_obj);
break;
}
yr_free((void*) object->identifier);
yr_free(object);
}
void yr_re_destroy(
RE* re)
{
if (re->root_node != NULL)
yr_re_node_destroy(re->root_node);
if (re->error_message != NULL)
yr_free((char*) re->error_message);
yr_free(re);
}
int yr_ac_automaton_destroy(
YR_AC_AUTOMATON* automaton)
{
_yr_ac_state_destroy(automaton->root);
yr_free(automaton->t_table);
yr_free(automaton->m_table);
yr_free(automaton);
return ERROR_SUCCESS;
}
void yr_re_node_destroy(
RE_NODE* node)
{
if (node->left != NULL)
yr_re_node_destroy(node->left);
if (node->right != NULL)
yr_re_node_destroy(node->right);
if (node->type == RE_NODE_CLASS)
yr_free(node->class_vector);
yr_free(node);
}
void yr_compiler_destroy(
YR_COMPILER* compiler)
{
int i;
if (compiler->compiled_rules_arena != NULL)
yr_arena_destroy(compiler->compiled_rules_arena);
if (compiler->sz_arena != NULL)
yr_arena_destroy(compiler->sz_arena);
if (compiler->rules_arena != NULL)
yr_arena_destroy(compiler->rules_arena);
if (compiler->strings_arena != NULL)
yr_arena_destroy(compiler->strings_arena);
if (compiler->code_arena != NULL)
yr_arena_destroy(compiler->code_arena);
if (compiler->re_code_arena != NULL)
yr_arena_destroy(compiler->re_code_arena);
if (compiler->automaton_arena != NULL)
yr_arena_destroy(compiler->automaton_arena);
if (compiler->externals_arena != NULL)
yr_arena_destroy(compiler->externals_arena);
if (compiler->namespaces_arena != NULL)
yr_arena_destroy(compiler->namespaces_arena);
if (compiler->metas_arena != NULL)
yr_arena_destroy(compiler->metas_arena);
yr_hash_table_destroy(
compiler->rules_table,
NULL);
yr_hash_table_destroy(
compiler->objects_table,
(YR_HASH_TABLE_FREE_VALUE_FUNC) yr_object_destroy);
for (i = 0; i < compiler->file_name_stack_ptr; i++)
yr_free(compiler->file_name_stack[i]);
yr_free(compiler);
}
YR_ARENA_PAGE* _yr_arena_new_page(
size_t size)
{
YR_ARENA_PAGE* new_page;
new_page = (YR_ARENA_PAGE*) yr_malloc(sizeof(YR_ARENA_PAGE));
if (new_page == NULL)
return NULL;
new_page->address = (uint8_t*) yr_malloc(size);
if (new_page->address == NULL)
{
yr_free(new_page);
return NULL;
}
new_page->size = size;
new_page->used = 0;
new_page->next = NULL;
new_page->prev = NULL;
new_page->reloc_list_head = NULL;
new_page->reloc_list_tail = NULL;
return new_page;
}
uint8_t* _yr_fetch_block_data(
YR_MEMORY_BLOCK* block)
{
YR_PROC_ITERATOR_CTX* context = (YR_PROC_ITERATOR_CTX*) block->context;
if (context->buffer_size < block->size)
{
if (context->buffer != NULL)
yr_free(context->buffer);
context->buffer = yr_malloc(block->size);
if (context->buffer != NULL)
{
context->buffer_size = block->size;
}
else
{
context->buffer_size = 0;
return NULL;
}
}
if (pread(context->mem_fd,
context->buffer,
block->size,
block->base) == -1)
{
return NULL;
}
return context->buffer;
}
int yr_arena_append(
YR_ARENA* target_arena,
YR_ARENA* source_arena)
{
uint8_t padding_data[15];
size_t padding_size = 16 - target_arena->current_page->used % 16;
if (padding_size < 16)
{
memset(&padding_data, 0xCC, padding_size);
FAIL_ON_ERROR(yr_arena_write_data(
target_arena,
padding_data,
padding_size,
NULL));
}
target_arena->current_page->next = source_arena->page_list_head;
source_arena->page_list_head->prev = target_arena->current_page;
target_arena->current_page = source_arena->current_page;
yr_free(source_arena);
return ERROR_SUCCESS;
}
YR_API void yr_hash_table_destroy(
YR_HASH_TABLE* table,
YR_HASH_TABLE_FREE_VALUE_FUNC free_value)
{
yr_hash_table_clean(table, free_value);
yr_free(table);
}
int yr_rules_define_string_variable(
YR_RULES* rules,
const char* identifier,
const char* value)
{
YR_EXTERNAL_VARIABLE* external;
external = rules->externals_list_head;
while (!EXTERNAL_VARIABLE_IS_NULL(external))
{
if (strcmp(external->identifier, identifier) == 0)
{
if (external->type == EXTERNAL_VARIABLE_TYPE_MALLOC_STRING &&
external->string != NULL)
{
yr_free(external->string);
}
external->type = EXTERNAL_VARIABLE_TYPE_MALLOC_STRING;
external->string = yr_strdup(value);
if (external->string == NULL)
return ERROR_INSUFICIENT_MEMORY;
else
return ERROR_SUCCESS;
}
external++;
}
return ERROR_SUCCESS;
}
YR_API const uint8_t* yr_process_fetch_memory_block_data(
YR_MEMORY_BLOCK* block)
{
YR_PROC_ITERATOR_CTX* context = (YR_PROC_ITERATOR_CTX*) block->context;
YR_PROC_INFO* proc_info = (YR_PROC_INFO*) context->proc_info;
if (context->buffer_size < block->size)
{
if (context->buffer != NULL)
yr_free((void*) context->buffer);
context->buffer = (const uint8_t*) yr_malloc(block->size);
if (context->buffer != NULL)
{
context->buffer_size = block->size;
}
else
{
context->buffer_size = 0;
return NULL;
}
}
if (pread(proc_info->mem_fd,
(void *) context->buffer,
block->size,
block->base) == -1)
{
return NULL;
}
return context->buffer;
}
int yr_arena_create(
size_t initial_size,
int flags,
YR_ARENA** arena)
{
YR_ARENA* new_arena;
YR_ARENA_PAGE* new_page;
*arena = NULL;
new_arena = (YR_ARENA*) yr_malloc(sizeof(YR_ARENA));
if (new_arena == NULL)
return ERROR_INSUFFICIENT_MEMORY;
new_page = _yr_arena_new_page(initial_size);
if (new_page == NULL)
{
yr_free(new_arena);
return ERROR_INSUFFICIENT_MEMORY;
}
new_arena->page_list_head = new_page;
new_arena->current_page = new_page;
new_arena->flags = flags | ARENA_FLAGS_COALESCED;
*arena = new_arena;
return ERROR_SUCCESS;
}
YR_API void yr_compiler_destroy(
YR_COMPILER* compiler)
{
YR_FIXUP* fixup;
int i;
yr_arena_destroy(compiler->compiled_rules_arena);
yr_arena_destroy(compiler->sz_arena);
yr_arena_destroy(compiler->rules_arena);
yr_arena_destroy(compiler->strings_arena);
yr_arena_destroy(compiler->code_arena);
yr_arena_destroy(compiler->re_code_arena);
yr_arena_destroy(compiler->externals_arena);
yr_arena_destroy(compiler->namespaces_arena);
yr_arena_destroy(compiler->metas_arena);
yr_arena_destroy(compiler->automaton_arena);
yr_arena_destroy(compiler->matches_arena);
yr_ac_automaton_destroy(compiler->automaton);
yr_hash_table_destroy(
compiler->rules_table,
NULL);
yr_hash_table_destroy(
compiler->strings_table,
NULL);
yr_hash_table_destroy(
compiler->objects_table,
(YR_HASH_TABLE_FREE_VALUE_FUNC) yr_object_destroy);
for (i = 0; i < compiler->file_name_stack_ptr; i++)
yr_free(compiler->file_name_stack[i]);
fixup = compiler->fixup_stack_head;
while (fixup != NULL)
{
YR_FIXUP* next_fixup = fixup->next;
yr_free(fixup);
fixup = next_fixup;
}
yr_free(compiler);
}
int yr_process_free_memory(
YR_MEMORY_BLOCK* first_block)
{
YR_MEMORY_BLOCK* block;
YR_MEMORY_BLOCK* next_block;
block = first_block;
while (block != NULL)
{
next_block = block->next;
yr_free(block->data);
yr_free(block);
block = next_block;
}
return 0;
}
int yr_process_close_iterator(
YR_MEMORY_BLOCK_ITERATOR* iterator)
{
YR_PROC_ITERATOR_CTX* context = (YR_PROC_ITERATOR_CTX*) iterator->context;
if (context != NULL)
{
_yr_process_detach(context);
if (context->buffer != NULL)
yr_free(context->buffer);
yr_free(context);
iterator->context = NULL;
}
return ERROR_SUCCESS;
}
void _yr_compiler_pop_file_name(
YR_COMPILER* compiler)
{
if (compiler->file_name_stack_ptr > 0)
{
compiler->file_name_stack_ptr--;
yr_free(compiler->file_name_stack[compiler->file_name_stack_ptr]);
compiler->file_name_stack[compiler->file_name_stack_ptr] = NULL;
}
}
int yr_arena_append(
YR_ARENA* target_arena,
YR_ARENA* source_arena)
{
target_arena->current_page->next = source_arena->page_list_head;
target_arena->current_page = source_arena->current_page;
yr_free(source_arena);
return ERROR_SUCCESS;
}
void yr_re_destroy(
RE* re)
{
if (re->root_node != NULL)
yr_re_node_destroy(re->root_node);
if (re->code_arena != NULL)
yr_arena_destroy(re->code_arena);
yr_free(re);
}
int yr_rules_scan_proc(
YR_RULES* rules,
int pid,
YR_CALLBACK_FUNC callback,
void* user_data,
int fast_scan_mode,
int timeout)
{
YR_MEMORY_BLOCK* first_block;
YR_MEMORY_BLOCK* next_block;
YR_MEMORY_BLOCK* block;
int result;
result = yr_process_get_memory(pid, &first_block);
if (result == ERROR_SUCCESS)
result = yr_rules_scan_mem_blocks(
rules,
first_block,
TRUE,
callback,
user_data,
fast_scan_mode,
timeout);
block = first_block;
while (block != NULL)
{
next_block = block->next;
yr_free(block->data);
yr_free(block);
block = next_block;
}
return result;
}
void yr_atoms_list_destroy(
YR_ATOM_LIST_ITEM* list_head)
{
YR_ATOM_LIST_ITEM* item = list_head;
YR_ATOM_LIST_ITEM* next;
while (item != NULL)
{
next = item->next;
yr_free(item);
item = next;
}
}
int _yr_process_attach(
int pid,
YR_PROC_ITERATOR_CTX* context)
{
TOKEN_PRIVILEGES tokenPriv;
LUID luidDebug;
HANDLE hToken = NULL;
YR_PROC_INFO* proc_info = (YR_PROC_INFO*) yr_malloc(sizeof(YR_PROC_INFO));
if (proc_info == NULL)
return ERROR_INSUFFICIENT_MEMORY;
if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken) &&
LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luidDebug))
{
tokenPriv.PrivilegeCount = 1;
tokenPriv.Privileges[0].Luid = luidDebug;
tokenPriv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges(
hToken,
FALSE,
&tokenPriv,
sizeof(tokenPriv),
NULL,
NULL);
}
if (hToken != NULL)
CloseHandle(hToken);
proc_info->hProcess = OpenProcess(
PROCESS_VM_READ | PROCESS_QUERY_INFORMATION,
FALSE,
pid);
if (proc_info->hProcess == NULL)
{
yr_free(proc_info);
return ERROR_COULD_NOT_ATTACH_TO_PROCESS;
}
GetSystemInfo(&proc_info->si);
context->proc_info = proc_info;
return ERROR_SUCCESS;
}
int _yr_ac_state_destroy(
YR_AC_STATE* state)
{
YR_AC_STATE* child_state = state->first_child;
while (child_state != NULL)
{
YR_AC_STATE* next_child_state = child_state->siblings;
_yr_ac_state_destroy(child_state);
child_state = next_child_state;
}
yr_free(state);
return ERROR_SUCCESS;
}
