VirusTotal/yara
1
0
Fork 0
mirror of https://github.com/VirusTotal/yara.git synced 2026-10-12 02:10:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix issue while parsing .NET resources

Browse Source 
.NET resources can be found outside the current file. Before this change those resources were being ignored, but now they are included in the `resources` array. The `name` and `length` fields are kept undefined though. So, external resources have only the `name` field set.
This commit is contained in:
Victor M. Alvarez
2024-03-18 20:21:12 +01:00
parent c009195c1e
commit 5bf72f2fb0
1 changed files with 29 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libyara/modules/dotnet/dotnet.c
+29 -44
View File
@@ -2932,10 +2932,6 @@ void dotnet_parse_tilde_2(
index_size = 2;
row_size = (4 + 4 + index_sizes.string + index_size);
// Using 'i' is insufficent since we may skip certain resources and
// it would give an inaccurate count in that case.
counter = 0;
row_ptr = table_offset;
// First DWORD is the offset.
@@ -2945,11 +2941,7 @@ void dotnet_parse_tilde_2(
break;
manifestresource_table = (PMANIFESTRESOURCE_TABLE) row_ptr;
resource_offset = yr_le32toh(manifestresource_table->Offset);
// Only set offset if it is in this file (implementation != 0).
// Can't use manifestresource_table here because the Name and
// Implementation fields are variable size.
if (index_size == 4)
implementation = yr_le32toh(
*(DWORD*) (row_ptr + 4 + 4 + index_sizes.string));
@@ -2957,38 +2949,7 @@ void dotnet_parse_tilde_2(
implementation = yr_le16toh(
*(WORD*) (row_ptr + 4 + 4 + index_sizes.string));
if (implementation != 0)
{
row_ptr += row_size;
continue;
}
if (!fits_in_pe(
pe, pe->data + resource_base + resource_offset, sizeof(DWORD)))
{
row_ptr += row_size;
continue;
}
resource_size = yr_le32toh(
*(DWORD*) (pe->data + resource_base + resource_offset));
if (!fits_in_pe(
pe, pe->data + resource_base + resource_offset, resource_size))
{
row_ptr += row_size;
continue;
}
// Add 4 to skip the size.
yr_set_integer(
resource_base + resource_offset + 4,
pe->object,
"resources[%i].offset",
counter);
yr_set_integer(
resource_size, pe->object, "resources[%i].length", counter);
row_ptr += row_size;
name = pe_get_dotnet_string(
pe,
@@ -2997,13 +2958,37 @@ void dotnet_parse_tilde_2(
DOTNET_STRING_INDEX(manifestresource_table->Name));
if (name != NULL)
yr_set_string(name, pe->object, "resources[%i].name", counter);
yr_set_string(name, pe->object, "resources[%i].name", i);
row_ptr += row_size;
counter++;
// Only set offset and length if it is in this file, otherwise continue
// with the next resource.
if (implementation != 0)
continue;
resource_offset = yr_le32toh(manifestresource_table->Offset);
if (!fits_in_pe(
pe, pe->data + resource_base + resource_offset, sizeof(DWORD)))
continue;
resource_size = yr_le32toh(
*(DWORD*) (pe->data + resource_base + resource_offset));
if (!fits_in_pe(
pe, pe->data + resource_base + resource_offset, resource_size))
continue;
// Add 4 to skip the size.
yr_set_integer(
resource_base + resource_offset + 4,
pe->object,
"resources[%i].offset",
i);
yr_set_integer(resource_size, pe->object, "resources[%i].length", i);
}
yr_set_integer(counter, pe->object, "number_of_resources");
yr_set_integer(i, pe->object, "number_of_resources");
table_offset += row_size * num_rows;
break;