-
Notifications
You must be signed in to change notification settings - Fork 939
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add support for using the 'dotnet' module in YARA rules #749
Conversation
run tc tests |
// dotnet.user_strings[dotnet.number_of_user_strings - 8] == "{\x001\x001\x001\x001\x001\x00-\x002\x002\x002\x002\x002\x00-\x002\x000\x000\x000\x001\x00-\x000\x000\x000\x000\x001\x00}\x00\x00" and | ||
// dotnet.user_strings[dotnet.number_of_user_strings - 6] == "{\x001\x001\x001\x001\x001\x00-\x002\x002\x002\x002\x002\x00-\x003\x000\x000\x000\x001\x00-\x000\x000\x000\x000\x001\x00}\x00\x00" and | ||
// dotnet.user_strings[dotnet.number_of_user_strings - 4] == "{\x001\x001\x001\x001\x001\x00-\x002\x002\x002\x002\x002\x00-\x004\x000\x000\x000\x001\x00-\x000\x000\x000\x000\x001\x00}\x00\x00" and | ||
// dotnet.user_strings[dotnet.number_of_user_strings - 2] == "{\x001\x001\x001\x001\x001\x00-\x002\x002\x002\x002\x002\x00-\x005\x000\x000\x000\x001\x00-\x000\x000\x000\x000\x001\x00}\x00\x00" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It seems that there is something wrong with the new YARA rule as the following two tests are failing:
tools.fileinfo.detection.packers.eziriz.EzirizDotnetTest_002 (sample_6.2.0.0_dotnet.exe_ --js[..]) [ FAIL ] (0.15s)
F
======================================================================
FAIL: test_fileinfo_json_output_is_correctly_parsed (tools.fileinfo.detection.packers.eziriz.EzirizDotnetTest_002)
----------------------------------------------------------------------
Traceback (most recent call last):
File "/home/tcagent/work/c1867d72f67fc407/retdec-regression-tests/tools/fileinfo/detection/packers/eziriz/test.py", line 38, in test_fileinfo_json_output_is_correctly_parsed
self.assertEqual(self.fileinfo.output['tools'][0]['name'], 'Eziriz .NET Reactor')
AssertionError: 'Microsoft' != 'Eziriz .NET Reactor'
- Microsoft
+ Eziriz .NET Reactor
----------------------------------------------------------------------
Ran 1 test in 0.002s
FAILED (failures=1)
tools.fileinfo.detection.packers.eziriz.EzirizDotnetTest_002 (sample_6.2.9.2_dotnet.exe_ --js[..]) [ FAIL ] (0.16s)
F
======================================================================
FAIL: test_fileinfo_json_output_is_correctly_parsed (tools.fileinfo.detection.packers.eziriz.EzirizDotnetTest_002)
----------------------------------------------------------------------
Traceback (most recent call last):
File "/home/tcagent/work/c1867d72f67fc407/retdec-regression-tests/tools/fileinfo/detection/packers/eziriz/test.py", line 38, in test_fileinfo_json_output_is_correctly_parsed
self.assertEqual(self.fileinfo.output['tools'][0]['name'], 'Eziriz .NET Reactor')
AssertionError: 'Microsoft' != 'Eziriz .NET Reactor'
- Microsoft
+ Eziriz .NET Reactor
----------------------------------------------------------------------
Ran 1 test in 0.003s
FAILED (failures=1)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It is worse. I think YARA rule is hitting, but for some reason we filter it out. I run it with vanilla yara
and the rule was found.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@s3rvac, @ladislav-zezula, @metthal
Marek clarified some issues here. This new rule is fundamentally different from other existing rules and cpdetect
(and maybe other tools) cannot deal with it. Other rules have strings to match. But this one gets detected, but there are no matches - cpdetect
throws it away, This is what would be considered Heuristic rule and until now, we would hardcode it into a C++ source code. I will try to modify the toolchain to deal with it, but I don't know how hard it will be and how many issues I come accross.
run tc tests |
run tc tests