From 01032a6cb26313e1838669418186563a4e5cfc2d Mon Sep 17 00:00:00 2001 From: "Victor M. Alvarez" Date: Fri, 17 Nov 2023 11:37:35 +0100 Subject: [PATCH] Fix bug while calculating the imphash in PE files. When the file imported DLLs that contained a dot (.) in its name, like `glib-2.0.dll`, the file extension was not properly removed, causing the the imphash to be wrong. --- libyara/modules/pe/pe.c | 2 +- tests/BUILD.bazel | 1 + ...757d7e319258fef40dad54532ee4355b86bc129f27345 | Bin 0 -> 6656 bytes tests/test-pe.c | 9 +++++++++ 4 files changed, 11 insertions(+), 1 deletion(-) create mode 100644 tests/data/e3d45a2865818756068757d7e319258fef40dad54532ee4355b86bc129f27345 diff --git a/libyara/modules/pe/pe.c b/libyara/modules/pe/pe.c index 2c9a5ed5..be488c03 100644 --- a/libyara/modules/pe/pe.c +++ b/libyara/modules/pe/pe.c @@ -2730,7 +2730,7 @@ define_function(imphash) // If extension is 'ocx', 'sys' or 'dll', chop it. - char* ext = strstr(dll->name, "."); + char* ext = strrchr(dll->name, '.'); if (ext && (strncasecmp(ext, ".ocx", 4) == 0 || strncasecmp(ext, ".sys", 4) == 0 || diff --git a/tests/BUILD.bazel b/tests/BUILD.bazel index bc158692..faabb5ba 100644 --- a/tests/BUILD.bazel +++ b/tests/BUILD.bazel @@ -119,6 +119,7 @@ cc_test( "data/ChipTune.efi", "data/c6f9709feccf42f2d9e22057182fe185f177fb9daaa2649b4669a24f2ee7e3ba_0h_410h", "data/ca21e1c32065352d352be6cde97f89c141d7737ea92434831f998080783d5386", + "data/e3d45a2865818756068757d7e319258fef40dad54532ee4355b86bc129f27345", "data/mtxex.dll", "data/mtxex_modified_rsrc_rva.dll", "data/pe_imports", diff --git a/tests/data/e3d45a2865818756068757d7e319258fef40dad54532ee4355b86bc129f27345 b/tests/data/e3d45a2865818756068757d7e319258fef40dad54532ee4355b86bc129f27345 new file mode 100644 index 0000000000000000000000000000000000000000..76974fcbee7b7f0d2ca02ebd5d8b4e7f07a066d0 GIT binary patch literal 6656 zcmeHMX;f3^y55-s2_#5>Fi8*)EK`_dRv=*z8Ny5y2_Xp(2no#u6c99^K%fm4tre@- z+EZI6oDhm-RzRh-t)*C?Vv8+aqQpu8C9>}hwWq^6_pEjAkMrxkYrXsV-sgS4DPPvw zU!KJ7Pyq-40FaP_AOLhgsI!o@=f8g}Luo^sPYr>~dZV@-u$WQXJ!&6kKrM{@y=EGK z+u~q)06>8lBIH>BpxOgr5#%b!b*zqu0|06*`~!j3wd@)TrGE=_wYm;#_#5~&0YH_G zRsnz?OxO6=)&bSM>h`Y-Ua=Vp0Eqgx6@N{pFw&`OOcwO~eFEL#|H-NVU>d6PSfeP= zvj}n$3ju)MKcfF{{f9mQFE^?e0G*?)fgT+DbB_1D z#vDIYK@I>k8bK@A0stG~fYSoYWK~jTe;eh!W#UTCz{M4;y6(K-A%-HH5 z*j)qeCyq@mRgf8GS;%r*K-Ho8`FSQ$X<(gD+bTRT-)WLaK66pf-P2N-ej8vZ)Ock$ znPJf_e+IIUb>UiNESb=rfKj}F$=nnrMC_=1Wx|1Em7q)^ClW~v91*XUKlj1qS{mn!)xhK>YSgU6(FvOiD5W%qcaIX$>(O^syt%W zKA9dgssxxbmS)r8vCvdo2tJJjDQ&`xZUOSS|^WVH_+la?BT) z@z(9i1k&j+^sQ8Mnd(^VW?SRsNma(77}zh&yI3>Nb$!$EL{0TJ-*qRkbd6&RkG*I< z#;PI)hD3SBTgj20_HiHG8TZvb?q6nDWaK0Bl}3vHLY6nU#9ur8@TL`Z_}jhSZ)$Lv zgSK`P!&>`Dt<<>3A(K3G3b?7K?C$VkXZOPfKMnMgYuqax{4%&4 zdgep5mH7tT0RI@Kb0K9Ru{B(L?@0w#@d&A=5*Y*9@6H}1#A+3NC|hly-xKNR*g&ck z*@J}R3fLF$!2>-ccfp0m&GmO{yQ?ZR^KXA&xSxQ65vtD)>3?{l^CN*L*__lFyHH=j zKbCMO1+JJy{&3MHO`g#i-W$#h3%C^4Mi`oJ?Nx@ot)728by1B) z!KBDJnDLxZ%gk-{@@zgaA1Jl})@eT`Zp1&Z!OoZrACC-BCvga)=ZI;9E!_F!M zaYLBBb#xZJJS@mQedM5)asG2xjx)HtoPoN0(Wg8k>0r1l>Lm4WgUi8%1-Fqb=Nawc zyc;fiGRlFTYw%JNqlaP5=Vnaygq`VyPA;s6I=8i2kK^DoeiR)TbxwV|lDs=;CTu}n zbre@c*)J$bXfghJA!^Hh{PHplIV2u8+dgx9b{5reOzMY1oipwoq>EpBcY#J4@e~hh zAoFB4MVe{PE{q(!oIfo`ytE*y@kb8_QmfOKX$NJR>OaRvJgUTeh>av!*wk{7(kY zY2qKM%tl&G<7V{Yk2KB944b~@YH#;;#>z_Dz%&K-k=AQ}jQw#f?Y3G?zvyD8R%;#h z6B`;-GuSgG;$;>v(;P%6((RjIUely)Xy)OQn;Ydn%`!OO&%)sAKFB4;;pYD@Bt-7-o^QL9G~--qUX%9x|4 z?d*NT&CuonJ8D8fJGabfzH}aQNawPq6Ug zLI-V6FddYkW<@`N;BlHA=jsIDVhTE-skc$XgLaVhUhBB5!?rW0PU^7r=;7uE5H{4t za8Hmiocpq#0VSB4SA_+Cq9!XfsaVGSRpDJG(=r;5#MUfc_391Dd^w?cG@#hHZ~a?A z>pS&IhLHAhp=Bq|`WDkJGj22?Vab{`uJ6y38Tz9}Z|@EQ4KQ8cK+P^Z%$HiE)JsZD ztJB}6-MM__38Ch01=p-mS^BvTrQY@1D=u|My2?z+X6Tj5V^;NnLsGN6S;Q&o2Wd%( zfv(rVvGAY0(~7>Y=qiftglCeZdigd7D5-NnW%Dl|e?px>P7a}LoGhl7Dsta*#ANKJ zj3e(_9`Aa&63wjharOe4{ugCfzQlW3K0oCjY(kV;<)NKy8fXUXpQWaML-cmAGX85bBYgz=ZoEmX!`weJ zYTCJ+YC^XhE4X|lMo#vhL)>ZiVZ4ErUY_p4TVS&q?p=61_t7FgIGss%6R>O}{L;~Y zr&bfV*JUe%#>(6|(vP16C)z$F(!Bic)GD7Ve^KtjTD5HH_&#~YYb2y1q9ZQwY0PCZ zZijyWUGl(kb^f_^RiH+SQmn#dZswl!z&`0Q)3}bpRMwrq1BkZ?Phh!5#(5;uswvGp zcO50$aTO-B=Tg!bwws-g8mASzCw{f~ZQgmbQPNUALPm=>ENi#)M%d;_-CP`eZjKF9 z&RN#0CyG8UzxK&ABY~SiGNqSBdjx%pUM zvJg9ej#>A!qr32IXfe}!`om7d45Phbbg6VZgR%LP)g-A^VASq1HmNu5;;x(?eDckD z(d6-#;1m~x;$}zejvW7YD!(lf3igHuA^P_CF~Vi@ zdV9bXudh0BFsmpsp}Ak#f8y-@fSj#QqdbNQS3^nHY8vkgQLm%D(i-VlvV(jX++y!y^?D8W1B*I1ZlINZm9MEjUy$e2hSW=W$JN*&bD@o4ZWELlumNkfstmF3 zo3&ZmG!6Rzan(AH&y@kp=8w~d{|cyF9pDb#);Zl_!WMxN)SP zt$S>_{}I(RRj<-%s@qd@_{z$>)JSlt(B$5B0iw})`o-8cM?1AogZj1gS#MA4D-8w? zq78o(97@O|HSW6BWxmX}?Z`{`);8Pt4R5j>muJ2ldFaq`Qd&>kPa$0g^bLfqIVyvi zfvrA91$XB85rcDCsg3ss46@G_5@d%D;F={o)dda4it?W0YHC1$J>APFa7l*gj<5e! zG|!yF)jZQz-sqbq;xv=%Q0sT1#xR4KEW)n=o}Tg&RC!fYVBBo?uP?;#X9JJ=ZkC34 zsc#Mq>`^-*K8T#gqB=V}ODF40#_O!_*7@A23r;)oxa)RK19=&3pr&lU*bAM5QLC$`Q#VjamrnQ$Z^tg9LK)E_Ky*~^@?$#lwx1xwMQgB$KJ^Isr;$S~ZwyFnit9O;C$%cC5nF7C9% zXA`}Khlj_5P~KD*s4?thPqES=8M;p<+#4RoLO+4_>Yq$`&>l%SZ(&V!gL#0XTjmMb zd?8oN(?hX1BB8W$XS=rjH_s<|M#Z(ssk3aG4gGNT1#WXt#hZuZ@bVt!M1 zhEsVSTU?M4W?JCt?ds*(_43}lsj#G|#BZ}xMv*|4Yb41)j=kwpE-K34Y!tc`g*8RG zs4x$y#mWP*TQGMBPyNqW3f{x;5fzTNtF6a3t(OqSZCc@{pHM6j?#eV6`!oRFS$#;s z142=DK93{C6vB3!pDyG}B&IA&goUPxd))h`$VP2|^8`|a1%|~!3fRyIh6`ndlvK7r z=8BV3f+-HNX%VxCzXlO+nXKushF0uwv>C6tIk&z|DlX4riluR?4?Z=EpD}Z z?zC)^RASkrY8xvEv*tLAc29=c@Uk&q&R1?YlSYeAiVKb178i+Yb=hOIWTyF%g517M z>Le1^E8D7ZmH;~{>GE}JSI!7~S*Q2apMX0x!$4O1j{t0&gwD&B<>vCl3{dppYiXC)CGn&w!aTN+ zE8v;@*T5%SLIhvXH+j|hjFoxhW|~Ya4m;Ie0Y4>?tV=d~?8e-Am%ZM|KB-hfM2yd^ z7AErxd7+X(o?h@aR9A2tmz11`VsnkVrgryua0+N5+35sXb}0jqBjP8xkL`HJ*R-+w z<>9U)?CcER7=E^x?MPz_1Zh_u&ndRq3b+M>pGZ(YZzl6@eS=u>WT*G<_-2Ep*JAte zoD;RVtQ;>MW393GVsUkB&sLZ-d)M;e2v>W3bbvV zSjD1H2AFkdlp$g_24%SerUpUBG|OD1-43}O%GB2J4LirT9d~Utjz)rozHiAlmKtZF zlW|$bNsjcDiOK?V>|VNYyd#_9NX#=1^)>K;mvMW_G8{9agPl#?9npY^Ud;puR+{41 zWA$;SdStQ*3T=tP6VVtmv@ObrfEIy0FG;pWIIQyq6vn{F+JKzo8s%z;Gcm!D@4vji zXlf9QvZK(Bq1LS@q4|17cth*hU#`r9C^I_)JQj<$$KtGsaR5fXva=XV*5m2x;qWLT z25o8tF7~vkH0=f&Dhx|>v`5mBr?AK>3+$?u6;e~Z4mcSDX5BR#)aiTbSHfOv*_Z%t zZ()4O6-jjEa18Gn5^-?UMWfNZUYPD8L||FddT%1;w4gl~-5Z6eJW6}>oCLuHvh1QX z#UnYGi&h)+!j1s*-YTj4UAHeW5;m*NPBn+DprAWli`>NA686egJ^kx)+#^RP(-60f z&E8X&Y)A}8tY^!l)kJSRZ)oCuxCGw4$uht(%Fh?jeN{f-KPY>lP***Q|3oLH|F3jesQfS1n+gyqG=Qi( z+y9g`L;5XOr{Vs|PC#+_-?&RqT>Uq05Q-cA#{E9b9fx-sxxeRe N*z2g5ZoL1S{WqA;6L$ar literal 0 HcmV?d00001 diff --git a/tests/test-pe.c b/tests/test-pe.c index d2b9cf72..c46171e2 100644 --- a/tests/test-pe.c +++ b/tests/test-pe.c @@ -276,6 +276,15 @@ int main(int argc, char** argv) }", "tests/data/tiny_empty_import_name"); + assert_true_rule_file( + "import \"pe\" \ + rule test { \ + condition: \ + pe.imphash() == \"d49b7870cb53f29ec3f42b11cc8bea8b\" \ + }", + "tests/data/" + "e3d45a2865818756068757d7e319258fef40dad54532ee4355b86bc129f27345"); + #endif #if defined(HAVE_LIBCRYPTO)