A tool to generate yara signatures from function blocks
Switch branches/tags
Nothing to show
Clone or download
Nick Hoffman
Nick Hoffman added logic fix
Latest commit 0ec2a86 Dec 8, 2014
Permalink
Failed to load latest commit information.
README.md Update README.md Nov 25, 2014
signature_builder.rb added logic fix Dec 8, 2014

README.md

Yara Signature Tool

Description

This is a utility written in ruby using the Capstone Engine to build yara rules from functions.

For now, the script will wildcard out calls and pushes that are referencing locations within the binary addr space.

Requirements

  • Capstone Engine
  • Crabstone
  • PeDump
  • optparse

Usage

Run with the -h to get back the help (not much there so far)

Usage: signature_builder.rb -f ~/Desktop/wmiprivse.exe -o 0x401980 -e 0x401A08
    -f, --file FILE                  Filename
    -o, --offset NUMBER              Beginning Offset
    -e, --end NUMBER                 Ending Offset
    -h, --help                       Show this message

Ending offset is optional, if you like you can leave it blank and the code will follow until a RETN is hit. The returned results printed in a form that you can copy and paste into an existing yara rule.

./signature_builder.rb -f ~/Desktop/wmiprivse.exe -o 0x4017d3 -e 0x4017f9

Which will return

    //6804010000		push	0x104
    //8D8C24A4000000		lea	ecx, dword ptr [esp + 0xa4]
    //51		push	ecx
    //8D54246C		lea	edx, dword ptr [esp + 0x6c]
    //6A08		push	8
    //52		push	edx
    //E864310000		call	0x404950
    //83C408		add	esp, 8
    //50		push	eax
    //FF15D0904000		call	dword ptr [0x4090d0]
    //85C0		test	eax, eax
    //7516		jne	0x401810
    $a = {68 04 01 00 00 8D 8C 24 A4 00 00 00 51 8D 54 24 6C 6A 08 52 E8 ?? ?? ?? ?? 83 C4 08 50 FF ?? ?? ?? ?? ?? 85 C0 75 16 }


Status

Alpha, still a lot of work to be done

To be implemented

  • wildcarding of mov's
  • wildcarding of lea's
  • wildcarding of jmp's to absolute locations