Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added a CustomScanner to wrap yr_scanner routines #5

Merged
merged 1 commit into from Aug 24, 2020

Conversation

ncatlin
Copy link
Contributor

@ncatlin ncatlin commented Aug 8, 2020

This PR deals with the external variable support TODO by creating a scanner with compiled rules and then calling it using external variables. It reuses most of the memory scanning code from the usual scanner and follows the same API format as the other externs so the actual changes are relatively minor.

It can be used like this:
`
public static void ExternVariableTest()
{
string ruleString = "rule EXE_cloaked_as_TXT {\nmeta:\n\tdescription = "Executable with TXT extension"\n" +
"\tlicense = "https://creativecommons.org/licenses/by-nc/4.0/\"\n" +
"\tauthor = "Florian Roth"\ncondition:\nuint16(0) == 0x5a4d and filename matches /\.txt$/is}";

        byte[] fileContentsBuf = Encoding.ASCII.GetBytes("MZ_other_file_contents");

        using (YaraContext ctx = new YaraContext())
        {
            // Compile list of yara rules
            CompiledRules rules = null;
            using (var compiler = new Compiler())
            {
                //compilation will fail if the variable used by a rule isn't declared at compile time
                compiler.DeclareExternalStringVariable("filename");
                compiler.AddRuleString(ruleString);
                rules = compiler.Compile();
            }

            // Initialize the scanner
            var scanner = new CustomScanner(rules);

            //add string, long, double, bool external variables
            ExternalVariables externalVariables = new ExternalVariables();
            externalVariables.StringVariables.Add("filename", "ExecutableFile.txt");

            List<ScanResult> scanResults = scanner.ScanMemory(ref fileContentsBuf, externalVariables);
            Debug.Assert(scanResults.Count == 1);
    }

}
`

@sbruyere sbruyere merged commit f9f8414 into airbus-cert:master Aug 24, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants