VirusTotal/yara
1
0
Fork 0
mirror of https://github.com/VirusTotal/yara.git synced 2026-10-11 22:49:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

LNK module (#1732)

Browse Source 
* LNK module initial commit

* Update atom logic to properly score [A-Z]

The documentation says `Bytes [a-zA-Z] contribute 18 points each`, but it looks like in the code that only `[a-z]` is given 18 points, whereas `[A-Z]` is given 20 points. This commit will make sure these ranges have the proper scoring as expected.

* Add test for comparing atom quality ABCD == abcd

Add test entry which compares the atom quality of "ABCD" and "abcd" and asserts that they are equal.

* Update test-atoms.c

* Revert "Update atom logic to properly score [A-Z]"

This reverts commit bf7130ff0b.

* Revert "Add test for comparing atom quality ABCD == abcd"

This reverts commit 181dbf2326.

* Revert "Update test-atoms.c"

This reverts commit 81239034b3.

* Test

* Revert "Test"

This reverts commit 1c53212b63.

* Add objects for LinkFlags parsing

Also fixed `DWORD` compiling error, and replaced with `uint32_t` types.

* Add file attribute flags

* Start hotkey parsing code

* Add the rest of the hotkey values

* Add initial test case for LNK module

Using the sample LNK from the MS standard for LNK files for testing, and putting in an initial test:
https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/%5bMS-SHLLINK%5d.pdf

* Add initial LNK tests

* Add has_hotkey variable

* Formatting

* Fix timestamps set

Previous version always seemed to be an hour (3600 seconds) off what it should have been. This commit adds a test to make sure it's getting the right value.

I don't know why its always an hour off, but this should fix it!

* Refactor hotkey char select into its own function

* Add a couple of comments

* Add min size for parsing LNK

All the mandatory LNK header bytes add up to 76 bytes, and as such we won't parse an LNK file unless it is at least 76 bytes in length

* Add LinkTargetIDList parsing

* Begin working on code for LinkInfo parsing

* Refactor code into header + util files

Moving a lot of the definitions over to a separate header file to keep the main code clean.

Also following the PE module's structure of having a separate `lnk_utils` file to deal with some of the convenient functions it provides.

* Starting VolumeID parsing

* Adding free statement

* Add some VolumeID tests and fix free error

* Finish parsing VolumeID

* Parse LocalBasePath

* Refactor to prevent unsafe memory copying

Start taking into account the remaining size in the block being scanned, to make sure we don't break anything when dereferencing pointers.

* Parse CommonPathSuffix

Also create empty function for when we need to parse CommonNetworkRelativeLink

* Parse LocalBasePathUnicode and CommonPathSuffixUnicode

NOTE: these will need some testing before this will be production ready, as I'm making a lot of assumptions here.

* Return size of LinkInfo section

* Add StringData parsing

* Add initial code for parsing ExtraData section

Only parsing `TrackerDataBlock` at the moment, but setting up values in advance of setting up the other structures/parsers

* Add the remaining ExtraData structures

In some cases I don't make a structure where the parsing function will just handle the data (e.g. where there is variable data).

I will likely also ignore PropertyStore for now as that has separate documentation to parse it.

* More specific parsing of Droid GUIDs

* Move code out of VolumeID parsing indent

The rest of the LinkInfo section wasn't parsing unless a VolumeID was present, which shouldn't be how it works.

* Remove incorrect CommonNetworkRelativeLinkOffset setting

Also add structure for CommonNetworkRelativeLink parsing

* Implement CommonNetworkRelativeLink parsing

And add a couple of test cases for it

* Formatting

* Make LinkInfo parsing memory safe

* Remove unnecessary constant

* Make StringData parsing memory safe

Also convert `block_data_size_remaining` to `int` from `size_t`. This is because we don't want to underflow the `size_t` type, and assume we have more data left than we actually do.

* Fix up block data size remaining calculations in ExtraData

* Add more constants

* Add in overlay variable

* Make current ExtraData function memory safe

* Setup switch/case for ExtraData parsing

* ConsoleDataBlock parsing

* Add ConsoleFedData parsing

* Convert tracker data to struct and add more fields

* Add extra fields to current ExtraData structures

* Refactor structures

* Rename sample LNKs

* Refactor into parse_volume_id

* Parse DarwinData and fixed up block struct entries

* Add is_malformed entry

Checks whether a LNK has failed parsing due to it being malformed.

* Add overlay test case

* Parse EnvironmentVariableDataBlock

* Parse IconEnvironmentDataBlock

* Add KnownFolderDataBlock parsing

* Add placeholder parsing for PropertyDataStoreBlock

* Parse ShimDataBlock

* Parse SpecialFolderDataBlock

* Remove id_list_ptr var

* Refactor into its own function to parse IDList

* Parse VistaAndAboveIDListDataBlock

* Remove printf

* Refactor item_id_list into structure

* Add LinkInfoFlags as external variables

* Only process relevant link info if flags set

* Update StringData to also accept ASCII

I assumed it would only be ASCII, but the `IsUnicode` flag can help indicate what type of string it is.

* Only parse ExtraData if there is data left

* Retype to strings

* Fix environment var data parsing

I thought wchar_t was 16 bits, but turns out it can also be 32 bits... I'll need to change up other routines to take this into account as well

* Move inside if statement to prevent setting

* Fix icon env unicode issue

* Convert remaining wchar_t struct entries

* Add ExtraData test cases

* Add ExtraData tests (2)

* Make sure timestamps are UTC

* Start LNK module documentation

* Add ShowCommand constants

* Finish documenting LNK headers

* Change test to flag comparison

* Correct structure names

* Update test-lnk.c

* Document LinkInfo section

* Document StringData

* Add more constants

* Document ConsoleData

* Update lnk.rst

* Finish documenting LNK module

* Some extra comments

* Update lnk.rst

* Apply clang formatting

* Removed test for now

* Add more flags and renamed console_fe_data

* Formatting

* Update comment on PropertyStoreData

* Change variable names due to potential clashes

Changed the variables used in header files:
- Reserved1
- Reserved2
- Unused1
- Unused2

The CI/CD seems to fail with these values as a default, so I'm hoping changing them fixes things

* Change packing to address misaligned pointer error

* Add LNK module to VS Projects

* Changed `block_data_size_remaining` to `unsigned int`

Make variable `unsigned int` instead of just `int` to prevent the value being negative.

* Begin removing static of strings

Starting with the ones I can test, by dynamically allocating memory after doing the check, I'm removing the possibility of there being a buffer overflow on this data.

* Dynamically allocate `volume_id_data`

* Remove more statically typed char arrays

* Dynamically allocate unicode strings

Previously were statically set in length, now dynamically allocated

* Add clearer comment

* Add todo

* Add `yr_` prefix to necessary functions

Due to #1762, needed to add `yr_` as a prefix to functions like `set_string`

* Convert 'unsigned int' to `uint32_t`

* Make constants have consistent casing

* Add extra checks on block size remaining

I found a case where a function returned a section size that was greater than the remaining block size, which caused a crash. This patch checks each value returned to make sure the next stage doesn't fail to parse.

* Fix docs for icon_location

Add `lnk.` prefix to `icon_location` variable

* Add LNK module back in

* Correct LNK module source path

* Add lnk_utils to modules list

And update other libyara auto changes

* Add LNK module tests

* Fix up LNK test in Makefile

* Fix typo in test LNK

* Attempt to fix bazel build

* Testing to see why Bazel build fails

* Revert removing tests

It seems even one test gives the error `There were tests whose specified size is too big. Use the --test_verbose_timeout_warnings command line option to see which ones these are.`

* Include LNK module in BUILD.bazel

* Add missing deps line

* Add lnk.h to Makefile

* Add lnk.h to yara.bzl

* Add lnk_utils.h to yara.bzl

* Revert automatic changes

Change some C/header files that got automatically changed while compiling YARA to the same that they are on the main branch

* Include lnk_utils in Makefile

* Convert some console data variables to signed and update docs

Some variables in the console data section are actually signed variables. So I've converted them to `int16_t` instead of `uint16_t`, added some test cases to make sure these values are properly parsed, and added some examples in the docs.

* Fix typo for window_size_y

* Add flags for LNK module

* Add extra time tests

Add tests for access time and write time
This commit is contained in:
John
2023-08-24 09:32:54 +02:00
committed by GitHub
parent a7b0a44703
commit 97fd691086
21 changed files with 4261 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+3
View File
@@ -90,3 +90,6 @@ windows/*/packages/
.vscode/
tests/mapper
# Sphinx build
/docs/_build/*
BUILD.bazel
+3
View File
@@ -80,6 +80,7 @@ yara_library(
"time",
"console",
"string",
"lnk",
],
modules_srcs = [
"libyara/modules/cuckoo/cuckoo.c",
@@ -96,6 +97,8 @@ yara_library(
"libyara/modules/time/time.c",
"libyara/modules/console/console.c",
"libyara/modules/string/string.c",
"libyara/modules/lnk/lnk.c",
"libyara/modules/lnk/lnk_utils.c",
],
deps = [
"@jansson",
Makefile.am
+10 -1
View File
@@ -98,6 +98,9 @@ MODULES += libyara/modules/console/console.c
MODULES += libyara/modules/string/string.c
MODULES += libyara/modules/lnk/lnk.c
MODULES += libyara/modules/lnk/lnk_utils.c
if CUCKOO_MODULE
MODULES += libyara/modules/cuckoo/cuckoo.c
endif
@@ -192,6 +195,8 @@ noinst_HEADERS = \
libyara/include/yara/pe.h \
libyara/include/yara/pe_utils.h \
libyara/include/yara/re_lexer.h \
libyara/include/yara/lnk.h \
libyara/include/yara/lnk_utils.h \
libyara/modules/module_list
dist_noinst_DATA = libyara/pb/yara.proto
@@ -348,6 +353,9 @@ test_re_split_LDFLAGS = -static
test_async_SOURCES = tests/test-async.c tests/util.c
test_async_LDADD = libyara.la
test_async_LDFLAGS = -static
test_lnk_SOURCES = tests/test-lnk.c tests/util.c
test_lnk_LDADD = libyara.la
test_lnk_LDFLAGS = -static
TESTS = $(check_PROGRAMS)
TESTS_ENVIRONMENT = TOP_SRCDIR=$(top_srcdir) TOP_BUILDDIR=$(top_builddir)
@@ -366,7 +374,8 @@ check_PROGRAMS = \
test-stack \
test-re-split \
test-async \
test-string
test-string \
test-lnk
EXTRA_PROGRAMS = tests/mapper
CLEANFILES = tests/mapper$(EXEEXT)
bazel/yara.bzl
+2
View File
@@ -171,6 +171,8 @@ def yara_library(
"libyara/include/yara/lexer.h",
"libyara/include/yara/libyara.h",
"libyara/include/yara/limits.h",
"libyara/include/yara/lnk.h",
"libyara/include/yara/lnk_utils.h",
"libyara/include/yara/macho.h",
"libyara/include/yara/mem.h",
"libyara/include/yara/modules.h",
docs/modules.rst
+1 -1
View File
@@ -22,6 +22,6 @@ modules in the :ref:`writing-modules` section.
Time <modules/time>
Console <modules/console>
String <modules/string>
LNK <modules/lnk>
docs/modules/lnk.rst
+741
View File
@@ -0,0 +1,741 @@
.. _lnk-module:
##########
LNK module
##########
The LNK module allows you to create more fine-grained rules for LNK files by
using attributes and features of the LNK file format. This module exposes most of
the fields present in an LNK file. Let's see some examples:
.. code-block:: yara
import "lnk"
rule is_lnk
{
condition:
lnk.is_lnk
}
rule machine_id_tracking
{
condition:
lnk.tracker_data.machine_id == "chris-xps"
}
rule local_base_path
{
condition:
lnk.link_info.local_base_path == "C:\\test\\a.txt"
}
The LNK documentation can be found on Microsoft's website:
https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-shllink/16cb4ca1-9339-4d0c-a68d-bf1d6cc0f943
Reference
---------
.. c:type:: is_lnk
Return true if the file is an LNK.
*Example: lnk.is_lnk*
.. c:type:: creation_time
An epoch integer that specifies the creation time (UTC) of the link target
*Example: lnk.creation_time == 1221247637*
.. c:type:: access_time
An epoch integer that specifies the access time (UTC) of the link target
*Example: lnk.access_time == 1221247637*
.. c:type:: write_time
An epoch integer that specifies the write time (UTC) of the link target
*Example: lnk.write_time == 1221247637*
.. c:type:: file_size
An unsigned integer that specifies the size, in bytes, of the link target
*Example: lnk.file_size > 100KB*
.. c:type:: link_flags
The LinkFlags value specifies information about the shell link and the presence of optional portions of the LNK file. Values can be checked by performing a bitwise AND operation with the following constants:
.. c:member:: HAS_LINK_TARGET_ID_LIST
.. c:member:: HAS_LINK_INFO
.. c:member:: HAS_NAME
.. c:member:: HAS_RELATIVE_PATH
.. c:member:: HAS_WORKING_DIR
.. c:member:: HAS_ARGUMENTS
.. c:member:: HAS_ICON_LOCATION
.. c:member:: IS_UNICODE
.. c:member:: FORCE_NO_LINK_INFO
.. c:member:: HAS_EXP_STRING
.. c:member:: RUN_IN_SEPARATE_PROCESS
.. c:member:: UNUSED_1
.. c:member:: HAS_DARWIN_ID
.. c:member:: RUN_AS_USER
.. c:member:: HAS_EXP_ICON
.. c:member:: NO_PIDL_ALIAS
.. c:member:: UNUSED_2
.. c:member:: RUN_WITH_SHIM_LAYER
.. c:member:: FORCE_NO_LINK_TRACK
.. c:member:: ENABLE_TARGET_METADATA
.. c:member:: DISABLE_LINK_PATH_TRACKING
.. c:member:: DISABLE_KNOWN_FOLDER_TRACKING
.. c:member:: DISABLE_KNOWN_FOLDER_ALIAS
.. c:member:: ALLOW_LINK_TO_LINK
.. c:member:: UNALIAS_ON_SAVE
.. c:member:: PREFER_ENVIRONMENT_PATH
.. c:member:: KEEP_LOCAL_ID_LIST_FOR_UNC_TARGET
*Example: lnk.link_flags & lnk.HAS_LINK_INFO*
.. c:type:: file_attributes_flags
A file attributes flag that specifies information about the link target. Values can be checked by performing a bitwise AND operation with the following constants:
.. c:member:: FILE_ATTRIBUTE_READONLY
.. c:member:: FILE_ATTRIBUTE_HIDDEN
.. c:member:: FILE_ATTRIBUTE_SYSTEM
.. c:member:: RESERVED_1
.. c:member:: FILE_ATTRIBUTE_DIRECTORY
.. c:member:: FILE_ATTRIBUTE_ARCHIVE
.. c:member:: RESERVED_2
.. c:member:: FILE_ATTRIBUTE_NORMAL
.. c:member:: FILE_ATTRIBUTE_TEMPORARY
.. c:member:: FILE_ATTRIBUTE_SPARSE_FILE
.. c:member:: FILE_ATTRIBUTE_REPARSE_POINT
.. c:member:: FILE_ATTRIBUTE_COMPRESSED
.. c:member:: FILE_ATTRIBUTE_OFFLINE
.. c:member:: FILE_ATTRIBUTE_NOT_CONTENT_INDEXED
.. c:member:: FILE_ATTRIBUTE_ENCRYPTED
*Example: lnk.file_attributes_flags & lnk.FILE_ATTRIBUTE_READONLY*
.. c:type:: icon_index
An integer that specifies the index of an icon within a given icon location.
.. c:type:: show_command
An unsigned integer that specifies the expected window state of an application launched by the link. This value should be equal to one of the following:
.. c:member:: FILE_ATTRIBUTE_READONLY
.. c:member:: FILE_ATTRIBUTE_HIDDEN
.. c:member:: FILE_ATTRIBUTE_SYSTEM
*Example: lnk.show_command == lnk.SW_SHOWNORMAL*
.. c:type:: has_hotkey
Boolean value to indicate whether a hotkey is present for the LNK file.
*Example: lnk.has_hotkey*
.. c:type:: hotkey_flags
Flags that detail the hotkey that's present (if applicable), and modifiers for how it should operate.
.. c:type:: hotkey
A string representing the hotkey that is assigned to launch the LNK.
*Example: lnk.hotkey == "F5"*
.. c:type:: hotkey_modifier_flags
An unsigned integer that specifies bits that correspond to modifier keys on the keyboard. This value must be one or a combination of the following:
.. c:member:: HOTKEYF_SHIFT
.. c:member:: HOTKEYF_CONTROL
.. c:member:: HOTKEYF_ALT
*Example: lnk.hotkey_modifier_flags & lnk.HOTKEYF_SHIFT*
.. c:type:: link_target_id_list
An optional structure that specifies the target of the link.
.. c:member:: number_of_item_ids
The number of ItemIDs within the list.
*Example: lnk.link_target_id_list.number_of_item_ids == 4*
.. c:member:: item_id_list_size
The size of the ItemID list.
*Example: lnk.link_target_id_list.item_id_list_size == 0xBD*
.. c:type:: item_id_list
A zero-based array of ItemIDs structures. The data stored in a given ItemID is defined by the source that corresponds to the location in the target namespace of the preceding ItemIDs. This data uniquely identifies the items in that part of the namespace. Each ItemID has the following members:
.. c:member:: data
The shell data source-defined data that specifies an item.
*Example: lnk.link_target_id_list.item_id_list[0].data == "\\x1fP\\xe0O\\xd0 \\xea:i\\x10\\xa2\\xd8\\x08\\x00+00\\x9d"*
.. c:member:: size
The size of the ItemID.
*Example: lnk.link_target_id_list.item_id_list[0].size == 0x12*
.. c:type:: link_info
The LinkInfo structure provides information necessary to resolve a link target if it is not found in its original location.
.. c:member:: size
An unsigned integer that specifies the size, in bytes, of the LinkInfo structure. All offsets specified in this structure MUST be less than this value, and all strings contained in this structure MUST fit within the extent defined by this size.
*Example: lnk.link_info.size == 0x3C*
.. c:member:: header_size
An unsigned integer that specifies the size, in bytes, of the LinkInfo header section. Note that if the value is 0x1C, then offsets to some optional fields (local_base_path_offset_unicode and common_path_suffix_offset_unicode) will not be set.
*Example: lnk.link_info.header_size == 0x1C*
.. c:member:: flags
Flags that specify whether the VolumeID, LocalBasePath, LocalBasePathUnicode, and CommonNetworkRelativeLink fields are present in this structure. Values can be checked by performing a bitwise AND operation with the following constants:
.. c:member:: VOLUME_ID_AND_LOCAL_BASE_PATH
.. c:member:: COMMON_NETWORK_RELATIVE_LINK_AND_PATH_SUFFIX
*Example: lnk.link_info.flags & lnk.VOLUME_ID_AND_LOCAL_BASE_PATH*
.. c:member:: volume_id_offset
An unsigned integer that specifies the location of the VolumeID field.
*Example: lnk.link_info.volume_id_offset == 0x1C*
.. c:member:: local_base_path_offset
An unsigned integer that specifies the location of the LocalBasePath field.
*Example: lnk.link_info.local_base_path_offset == 0x2D*
.. c:member:: common_network_relative_link_offset
An unsigned integer that specifies the location of the CommonNetworkRelativeLink field.
.. c:member:: common_path_suffix_offset
An unsigned integer that specifies the location of the CommonPathSuffix field.
.. c:member:: local_base_path_offset_unicode
An optional unsigned integer that specifies the location of the LocalBasePathUnicode field.
.. c:member:: common_path_suffix_offset_unicode
An optional unsigned integer that specifies the location of the CommonPathSuffixUnicode field.
.. c:type:: has_volume_id
Boolean flag which is set if a VolumeID structure is present.
*Example: lnk.link_info.has_volume_id*
.. c:type:: volume_id
An optional VolumeID structure (section 2.3.1) that specifies information about the volume that the link target was on when the link was created.
.. c:member:: size
The size of the structure.
.. c:member:: drive_type
An unsigned integer that specifies the type of drive the link target is stored on. It must be equal to one of the following:
.. c:member:: DRIVE_UNKNOWN
.. c:member:: DRIVE_NO_ROOT_DIR
.. c:member:: DRIVE_REMOVABLE
.. c:member:: DRIVE_FIXED
.. c:member:: DRIVE_REMOTE
.. c:member:: DRIVE_CDROM
.. c:member:: DRIVE_RAMDISK
*Example: lnk.link_info.volume_id.drive_type & lnk.DRIVE_FIXED*
.. c:member:: drive_serial_number
An unsigned integer that specifies the drive serial number of the volume the link target is stored on.
*Example: lnk.link_info.volume_id.drive_serial_number == 0x307A8A81*
.. c:member:: volume_label_offset
An unsigned integer that specifies the location of a string that contains the volume label of the drive that the link target is stored on.
.. c:member:: volume_label_offset_unicode
An optional unsigned integer that specifies the location of a string that contains the volume label of the drive that the link target is stored on.
.. c:member:: data
A buffer of data that contains the volume label of the drive as a string defined by the system default code page or Unicode characters, as specified by preceding fields.
*Example: lnk.link_info.volume_id.data == "\\x00"*
.. c:member:: local_base_path
An optional, NULL–terminated string, defined by the system default code page, which is used to construct the full path to the link item or link target by appending the string in the CommonPathSuffix field.
*Example: lnk.link_info.local_base_path == "C:\\test\\a.txt"*
.. c:type:: common_network_relative_link
The CommonNetworkRelativeLink structure specifies information about the network location where a link target is stored, including the mapped drive letter and the UNC path prefix.
.. c:member:: size
The size of the structure.
.. c:member:: flags
Flags that specify the contents of the DeviceNameOffset and NetProviderType fields. Values can be checked by performing a bitwise AND operation with the following constants:
.. c:member:: VALID_DEVICE
.. c:member:: VALID_NET_TYPE
*Example: lnk.common_network_relative_link.flags & lnk.VALID_DEVICE*
.. c:member:: net_name_offset
An unsigned integer that specifies the location of the NetName field.
.. c:member:: device_name_offset
An unsigned integer that specifies the location of the DeviceName field.
.. c:member:: network_provider_type
An unsigned integer that specifies the type of network provider. If present, it must be one of the following:
.. c:member:: WNNC_NET_AVID
.. c:member:: WNNC_NET_DOCUSPACE
.. c:member:: WNNC_NET_MANGOSOFT
.. c:member:: WNNC_NET_SERNET
.. c:member:: WNNC_NET_RIVERFRONT1
.. c:member:: WNNC_NET_RIVERFRONT2
.. c:member:: WNNC_NET_DECORB
.. c:member:: WNNC_NET_PROTSTOR
.. c:member:: WNNC_NET_FJ_REDIR
.. c:member:: WNNC_NET_DISTINCT
.. c:member:: WNNC_NET_TWINS
.. c:member:: WNNC_NET_RDR2SAMPLE
.. c:member:: WNNC_NET_CSC
.. c:member:: WNNC_NET_3IN1
.. c:member:: WNNC_NET_EXTENDNET
.. c:member:: WNNC_NET_STAC
.. c:member:: WNNC_NET_FOXBAT
.. c:member:: WNNC_NET_YAHOO
.. c:member:: WNNC_NET_EXIFS
.. c:member:: WNNC_NET_DAV
.. c:member:: WNNC_NET_KNOWARE
.. c:member:: WNNC_NET_OBJECT_DIRE
.. c:member:: WNNC_NET_MASFAX
.. c:member:: WNNC_NET_HOB_NFS
.. c:member:: WNNC_NET_SHIVA
.. c:member:: WNNC_NET_IBMAL
.. c:member:: WNNC_NET_LOCK
.. c:member:: WNNC_NET_TERMSRV
.. c:member:: WNNC_NET_SRT
.. c:member:: WNNC_NET_QUINCY
.. c:member:: WNNC_NET_OPENAFS
.. c:member:: WNNC_NET_AVID1
.. c:member:: WNNC_NET_DFS
.. c:member:: WNNC_NET_KWNP
.. c:member:: WNNC_NET_ZENWORKS
.. c:member:: WNNC_NET_DRIVEONWEB
.. c:member:: WNNC_NET_VMWARE
.. c:member:: WNNC_NET_RSFX
.. c:member:: WNNC_NET_MFILES
.. c:member:: WNNC_NET_MS_NFS
.. c:member:: WNNC_NET_GOOGLE
*Example: lnk.common_network_relative_link.network_provider_type == lnk.WNNC_NET_GOOGLE*
.. c:member:: net_name_offset_unicode
An unsigned integer that specifies the location of the NetNameUnicode field.
.. c:member:: device_name_offset_unicode
An unsigned integer that specifies the location of the DeviceNameUnicode field.
.. c:member:: net_name
A NULL–terminated string, as defined by the system default code page, which specifies a server share path.
*Example: lnk.link_info.common_network_relative_link.net_name == "\\\\server\\share"*
.. c:member:: device_name
A NULL–terminated string, as defined by the system default code page, which specifies a device.
*Example: lnk.link_info.common_network_relative_link.device_name == "Z:"*
.. c:member:: net_name_unicode
An optional, NULL–terminated, Unicode string that is the Unicode version of the NetName string.
.. c:member:: device_name_unicode
An optional, NULL–terminated, Unicode string that is the Unicode version of the DeviceName string.
.. c:member:: common_path_suffix
A NULL–terminated string, defined by the system default code page, which is used to construct the full path to the link item or link target by being appended to the string in the LocalBasePath field.
*Example: lnk.link_info.common_path_suffix == "\\x00"*
.. c:member:: local_base_path_unicode
An optional, NULL–terminated, Unicode string that is used to construct the full path to the link item or link target by appending the string in the CommonPathSuffixUnicode field.
.. c:member:: common_path_suffix_unicode
An optional, NULL–terminated, Unicode string that is used to construct the full path to the link item or link target by being appended to the string in the LocalBasePathUnicode field.
.. c:type:: name_string
An optional string that specifies a description of the shortcut that is displayed to end users to identify the purpose of the shell link.
*Example: lnk.name_string == "P\\x00e\\x00a\\x00Z\\x00i\\x00p\\x00 \\x00a\\x00r\\x00c\\x00h\\x00i\\x00v\\x00e\\x00r\\x00,\\x00 \\x00a\\x00d\\x00d\\x00 \\x00t\\x00o\\x00 \\x00e\\x00n\\x00c\\x00r\\x00y\\x00p\\x00t\\x00e\\x00d\\x00 \\x00.\\x00p\\x00e\\x00a\\x00 \\x00a\\x00r\\x00c\\x00h\\x00i\\x00v\\x00e\\x00"*
.. c:type:: relative_path
An optional string that specifies the location of the link target relative to the file that contains the shell link.
*Example: lnk.relative_path == ".\\x00\\\\\\x00a\\x00.\\x00t\\x00x\\x00t\\x00"*
.. c:type:: working_dir
An optional string that specifies the file system path of the working directory to be used when activating the link target.
*Example: lnk.working_dir == "C\\x00:\\x00\\\\\\x00t\\x00e\\x00s\\x00t\\x00"*
.. c:type:: command_line_arguments
An optional string that stores the command-line arguments that are specified when activating the link target
*Example: lnk.command_line_arguments == "-\\x00a\\x00d\\x00d\\x002\\x00c\\x00r\\x00y\\x00p\\x00t\\x00"*
.. c:type:: icon_location
An optional string that specifies the location of the icon to be used when displaying a shell link item in an icon view.
*Example: lnk.icon_location == "C\\x00:\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00 \\x00F\\x00i\\x00l\\x00e\\x00s\\x00\\\\x00P\\x00e\\x00a\\x00Z\\x00i\\x00p\\x00\\\\x00r\\x00e\\x00s\\x00\\\\x00i\\x00c\\x00o\\x00n\\x00s\\x00\\\\x00p\\x00e\\x00a\\x00z\\x00i\\x00p\\x00_\\x00n\\x00e\\x00w\\x00.\\x00i\\x00c\\x00l\\x00"*
.. c:type:: has_console_data
Boolean flag which is set if a ConsoleDataBlock structure is present.
*Example: lnk.has_console_data*
.. c:type:: console_data
The ConsoleDataBlock structure specifies the display settings to use when a link target specifies an application that is run in a console window.
.. c:member:: block_size
The block size of this structure, which will be equal to lnk.CONSOLE_DATA_BLOCK_SIZE.
.. c:member:: block_signature
The signature of the block, which will be equal to lnk.CONSOLE_DATA_BLOCK_SIGNATURE.
.. c:member:: fill_attributes
An unsigned integer that specifies the fill attributes that control the foreground and background text colors in the console window. The following bit definitions can be combined to specify 16 different values each for the foreground and background color:
.. c:member:: FOREGROUND_BLUE
.. c:member:: FOREGROUND_GREEN
.. c:member:: FOREGROUND_RED
.. c:member:: FOREGROUND_INTENSITY
.. c:member:: BACKGROUND_BLUE
.. c:member:: BACKGROUND_GREEN
.. c:member:: BACKGROUND_RED
.. c:member:: BACKGROUND_INTENSITY
*Example: lnk.console_data.fill_attributes & lnk.FOREGROUND_BLUE*
.. c:member:: popup_fill_attributes
An unsigned integer that specifies the fill attributes that control the foreground and background text color in the console window popup. The values are the same as for the FillAttributes field.
.. c:member:: screen_buffer_size_x
A signed integer that specifies the horizontal size (X axis), in characters, of the console window buffer.
*Example: lnk.console_data.screen_buffer_size_x == 120*
.. c:member:: screen_buffer_size_y
A signed integer that specifies the vertical size (Y axis), in characters, of the console window buffer.
*Example: lnk.console_data.screen_buffer_size_y == 3000*
.. c:member:: window_size_x
A signed integer that specifies the horizontal size (X axis), in characters, of the console window.
*Example: lnk.console_data.window_size_x == 120*
.. c:member:: window_size_y
A signed integer that specifies the vertical size (Y axis), in characters, of the console window.
*Example: lnk.console_data.window_size_y == 50*
.. c:member:: window_origin_x
A signed integer that specifies the horizontal coordinate (X axis), in pixels, of the console window origin.
*Example: lnk.console_data.window_origin_x == 0*
.. c:member:: window_origin_y
A signed integer that specifies the vertical coordinate (Y axis), in pixels, of the console window origin.
*Example: lnk.console_data.window_origin_y == 0*
.. c:member:: font_size
An unsigned integer that specifies the size, in pixels, of the font used in the console window. The two most significant bytes contain the font height and the two least significant bytes contain the font width. For vector fonts, the width is set to zero.
.. c:member:: font_family
An unsigned integer that specifies the family of the font used in the console window. This value must be comprised of a font family and a font pitch. The values for the font family are as follows:
.. c:member:: FF_DONTCARE
.. c:member:: FF_ROMAN
.. c:member:: FF_SWISS
.. c:member:: FF_MODERN
.. c:member:: FF_SCRIPT
.. c:member:: FF_DECORATIVE
A bitwise OR of one or more of the following font-pitch bits is added to the font family from the previous values:
.. c:member:: TMPF_NONE
.. c:member:: TMPF_FIXED_PITCH
.. c:member:: TMPF_VECTOR
.. c:member:: TMPF_TRUETYPE
.. c:member:: TMPF_DEVICE
.. c:member:: font_weight
An unsigned integer that specifies the stroke weight of the font used in the console window.
.. c:member:: face_name
A 32-character Unicode string that specifies the face name of the font used in the console window.
.. c:member:: cursor_size
An unsigned integer that specifies the size of the cursor, in pixels, used in the console window.
.. c:member:: full_screen
An unsigned integer that specifies whether to open the console window in full-screen mode.
.. c:member:: quick_edit
An unsigned integer that specifies whether to open the console window in QuickEdit mode.
.. c:member:: insert_mode
An unsigned integer that specifies insert mode in the console window.
.. c:member:: auto_position
An unsigned integer that specifies auto-position mode of the console window.
.. c:member:: history_buffer_size
An unsigned integer that specifies the size, in characters, of the buffer that is used to store a history of user input into the console window
.. c:member:: number_of_history_buffers
An unsigned integer that specifies the number of history buffers to use.
.. c:member:: history_no_dup
An unsigned integer that specifies whether to remove duplicates in the history buffer.
.. c:member:: color_table
A table of 16 32-bit, unsigned integers specifying the RGB colors that are used for text in the console window. The values of the fill attribute fields FillAttributes and PopupFillAttributes are used as indexes into this table to specify the final foreground and background color for a character.
.. c:type:: has_console_fe_data
Boolean flag which is set if a ConsoleFEDataBlock structure is present.
*Example: lnk.has_console_fe_data*
.. c:type:: console_fe_data
The ConsoleFEDataBlock structure specifies the code page to use for displaying text when a link target specifies an application that is run in a console window.
.. c:member:: block_size
The block size of this structure, which will be equal to lnk.CONSOLE_FE_DATA_BLOCK_SIZE.
.. c:member:: block_signature
The signature of the block, which will be equal to lnk.CONSOLE_FE_DATA_BLOCK_SIGNATURE.
.. c:member:: code_page
An unsigned integer that specifies a code page language code identifier.
.. c:type:: has_darwin_data
Boolean flag which is set if a DarwinDataBlock structure is present.
*Example: lnk.has_darwin_data*
.. c:type:: darwin_data
The DarwinDataBlock structure specifies an application identifier that can be used instead of a link target IDList to install an application when a shell link is activated.
.. c:member:: block_size
The block size of this structure, which will be equal to lnk.DARWIN_DATA_BLOCK_SIZE.
.. c:member:: block_signature
The signature of the block, which will be equal to lnk.DARWIN_DATA_BLOCK_SIGNATURE.
.. c:member:: darwin_data_ansi
A NULL–terminated string, defined by the system default code page, which specifies an application identifier.
.. c:member:: darwin_data_unicode
An optional, NULL–terminated, Unicode string that specifies an application identifier.
.. c:type:: has_environment_variable_data
Boolean flag which is set if a EnvironmentVariableDataBlock structure is present.
*Example: lnk.has_environment_variable_data*
.. c:type:: environment_variable_data
The EnvironmentVariableDataBlock structure specifies a path to environment variable information when the link target refers to a location that has a corresponding environment variable.
.. c:member:: block_size
The block size of this structure, which will be equal to lnk.ENVIRONMENT_VARIABLE_DATA_BLOCK_SIZE.
.. c:member:: block_signature
The signature of the block, which will be equal to lnk.ENVIRONMENT_VARIABLE_DATA_BLOCK_SIGNATURE.
.. c:member:: target_ansi
A NULL-terminated string, defined by the system default code page, which specifies a path to environment variable information
*Example: lnk.environment_variable_data.target_ansi == "%SystemRoot%\\sysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe"*
.. c:member:: target_unicode
An optional, NULL-terminated, Unicode string that specifies a path to environment variable information.
.. c:type:: has_icon_environment_data
Boolean flag which is set if a IconEnvironmentDataBlock structure is present.
*Example: lnk.has_icon_environment_data*
.. c:type:: icon_environment_data
The IconEnvironmentDataBlock structure specifies the path to an icon. The path is encoded using environment variables, which makes it possible to find the icon across machines where the locations vary but are expressed using environment variables.
.. c:member:: block_size
The block size of this structure, which will be equal to lnk.ICON_ENVIRONMENT_DATA_BLOCK_SIZE.
.. c:member:: block_signature
The signature of the block, which will be equal to lnk.ICON_ENVIRONMENT_DATA_BLOCK_SIGNATURE.
.. c:member:: target_ansi
A NULL-terminated string, defined by the system default code page, which specifies a path that is constructed with environment variables
*Example: lnk.icon_environment_data.target_ansi == "%ProgramFiles%\\PeaZip\\res\\icons\\peazip_new.icl"*
.. c:member:: target_unicode
An optional, NULL-terminated, Unicode string that specifies a path that is constructed with environment variables.
.. c:type:: has_known_folder_data
Boolean flag which is set if a KnownFolderDataBlock structure is present.
*Example: lnk.has_known_folder_data*
.. c:type:: known_folder_data
The KnownFolderDataBlock structure specifies the location of a known folder. This data can be used when a link target is a known folder to keep track of the folder so that the link target IDList can be translated when the link is loaded.
.. c:member:: block_size
The block size of this structure, which will be equal to lnk.KNOWN_FOLDER_DATA_BLOCK_SIZE.
.. c:member:: block_signature
The signature of the block, which will be equal to lnk.KNOWN_FOLDER_DATA_BLOCK_SIGNATURE.
.. c:member:: offset
An unsigned integer that specifies the location of the ItemID of the first child segment of the IDList specified by KnownFolderID. This value is the offset, in bytes, into the link target IDList.
*Example: lnk.known_folder_data.offset == 177*
.. c:member:: known_folder_id
A value in GUID packet representation that specifies the folder GUID ID.
*Example: lnk.known_folder_data.known_folder_id[15] == 142*
.. c:type:: has_property_store_data
Boolean flag which is set if a PropertyStoreDataBlock structure is present.
*Example: lnk.has_property_store_data*
.. c:type:: property_store_data
A PropertyStoreDataBlock structure specifies a set of properties that can be used by applications to store extra data in the shell link. (TODO: implement the rest of this structure)
.. c:member:: block_size
The block size of this structure, which will be greater than or equal to lnk.PROPERTY_STORE_DATA_BLOCK_MIN_SIZE.
.. c:member:: block_signature
The signature of the block, which will be equal to lnk.PROPERTY_STORE_DATA_BLOCK_SIGNATURE.
.. c:type:: has_shim_data
Boolean flag which is set if a ShimDataBlock structure is present.
*Example: lnk.has_shim_data*
.. c:type:: shim_data
The ShimDataBlock structure specifies the name of a shim that can be applied when activating a link target.
.. c:member:: block_size
The block size of this structure, which will be greater than or equal to lnk.SHIM_DATA_BLOCK_MIN_SIZE.
.. c:member:: block_signature
The signature of the block, which will be equal to lnk.SHIM_DATA_BLOCK_SIGNATURE.
.. c:member:: layer_name
A Unicode string that specifies the name of a shim layer to apply to a link target when it is being activated.
.. c:type:: has_special_folder_data
Boolean flag which is set if a SpecialFolderDataBlock structure is present.
*Example: lnk.has_special_folder_data*
.. c:type:: special_folder_data
The SpecialFolderDataBlock structure specifies the location of a special folder. This data can be used when a link target is a special folder to keep track of the folder, so that the link target IDList can be translated when the link is loaded.
.. c:member:: block_size
The block size of this structure, which will be equal to lnk.SPECIAL_FOLDER_DATA_BLOCK_SIZE.
.. c:member:: block_signature
The signature of the block, which will be equal to lnk.SPECIAL_FOLDER_DATA_BLOCK_SIGNATURE.
.. c:member:: offset
An unsigned integer that specifies the location of the ItemID of the first child segment of the IDList specified by SpecialFolderID. This value is the offset, in bytes, into the link target IDList.
.. c:member:: special_folder_id
An unsigned integer that specifies the folder integer ID.
.. c:type:: has_tracker_data
Boolean flag which is set if a TrackerDataBlock structure is present.
*Example: lnk.has_tracker_data*
.. c:type:: tracker_data
The TrackerDataBlock structure specifies data that can be used to resolve a link target if it is not found in its original location when the link is resolved. This data is passed to the Link Tracking service to find the link target.
.. c:member:: block_size
The block size of this structure, which will be equal to lnk.TRACKER_DATA_BLOCK_SIZE.
.. c:member:: block_signature
The signature of the block, which will be equal to lnk.TRACKER_DATA_BLOCK_SIGNATURE.
.. c:member:: machine_id
A NULL–terminated character string, as defined by the system default code page, which specifies the NetBIOS name of the machine where the link target was last known to reside.
*Example: lnk.tracker_data.machine_id == "chris-xps"*
.. c:member:: droid_volume_identifier
A parsed Droid volume identifier GUID.
*Example: lnk.tracker_data.droid_volume_identifier == "\\x40\\x78\\xC7\\x94\\x47\\xFA\\xC7\\x46\\xB3\\x56\\x5C\\x2D\\xC6\\xB6\\xD1\\x15"*
.. c:member:: droid_file_identifier
A parsed Droid file identifier GUID.
.. c:member:: droid_birth_volume_identifier
A parsed DroidBirth volume identifier GUID.
.. c:member:: droid_birth_file_identifier
A parsed DroidBirth file identifier GUID.
.. c:type:: has_vista_and_above_id_list_data
Boolean flag which is set if a VistaAndAboveIDListDataBlock structure is present.
*Example: lnk.has_vista_and_above_id_list_data*
.. c:type:: vista_and_above_id_list_data
The VistaAndAboveIDListDataBlock structure specifies an alternate IDList that can be used instead of the LinkTargetIDList structure on platforms that support it.
.. c:member:: block_size
The block size of this structure, which will be greater than or equal to lnk.VISTA_AND_ABOVE_ID_LIST_DATA_BLOCK_MIN_SIZE.
.. c:member:: block_signature
The signature of the block, which will be equal to lnk.VISTA_AND_ABOVE_ID_LIST_DATA_BLOCK_SIGNATURE.
.. c:member:: number_of_item_ids
The number of ItemID entries in the list.
.. c:type:: item_id_list
A zero-based array of ItemIDs structures. The data stored in a given ItemID is defined by the source that corresponds to the location in the target namespace of the preceding ItemIDs. This data uniquely identifies the items in that part of the namespace. Each ItemID has the following members:
.. c:member:: data
The shell data source-defined data that specifies an item.
.. c:member:: size
The size of the ItemID.
.. c:type:: has_overlay
A boolean value that is true if the LNK has extra data appended to it.
*Example: lnk.has_overlay*
.. c:type:: overlay_offset
An unsigned integer representing the offset into the LNK file of where the overlay starts (only set if the has_overlay flag is true).
*Example: lnk.overlay_offset == 0x1CB*
.. c:type:: is_malformed
A boolean value that is true if the LNK failed to be parsed due to it having malformed data.
*Example: lnk.is_malformed*
libyara/include/yara/lnk.h
+294
View File
@@ -0,0 +1,294 @@
#include <yara/integers.h>
#ifndef _LNK_H
#define _LNK_H
#define TICKS_PER_SECOND 10000000
#define EPOCH_DIFFERENCE 11644473600LL
#pragma pack(push)
#pragma pack(1)
typedef struct _shell_link_header_t
{
uint32_t header_size;
uint32_t clsid[4];
uint32_t link_flags;
uint32_t file_attributes_flags;
uint64_t creation_time;
uint64_t access_time;
uint64_t write_time;
uint32_t file_size;
uint32_t icon_index;
uint32_t show_command;
uint16_t hotkey_flags;
uint16_t reserved1;
uint32_t reserved2;
uint32_t reserved3;
} shell_link_header_t;
typedef struct _link_info_fixed_header_t
{
uint32_t link_info_size;
uint32_t link_info_header_size;
uint32_t link_info_flags;
uint32_t volume_id_offset;
uint32_t local_base_path_offset;
uint32_t common_network_relative_link_offset;
uint32_t common_path_suffix_offset;
} link_info_fixed_header_t;
typedef struct _volume_id_t
{
uint32_t volume_id_size;
uint32_t drive_type;
uint32_t drive_serial_number;
uint32_t volume_label_offset;
} volume_id_t;
typedef struct _common_network_relative_link_t
{
uint32_t common_network_relative_link_size;
uint32_t common_network_relative_link_flags;
uint32_t net_name_offset;
uint32_t device_name_offset;
uint32_t network_provider_type;
} common_network_relative_link_t;
typedef struct _console_data_block_t
{
uint16_t fill_attributes;
uint16_t popup_fill_attributes;
int16_t screen_buffer_size_x;
int16_t screen_buffer_size_y;
int16_t window_size_x;
int16_t window_size_y;
int16_t window_origin_x;
int16_t window_origin_y;
uint32_t unused_1;
uint32_t unused_2;
uint32_t font_size;
uint32_t font_family;
uint32_t font_weight;
uint16_t face_name[32];
uint32_t cursor_size;
uint32_t full_screen;
uint32_t quick_edit;
uint32_t insert_mode;
uint32_t auto_position;
uint32_t history_buffer_size;
uint32_t number_of_history_buffers;
uint32_t history_no_dup;
uint32_t color_table[16];
} console_data_block_t;
typedef struct _console_fe_data_block_t
{
uint32_t code_page;
} console_fe_data_block_t;
typedef struct _darwin_data_block_t
{
char darwin_data_ansi[260];
uint16_t darwin_data_unicode[260];
} darwin_data_block_t;
typedef struct _environment_variable_data_block_t
{
char target_ansi[260];
uint16_t target_unicode[260];
} environment_variable_data_block_t;
typedef struct _icon_environment_data_block_t
{
char target_ansi[260];
uint16_t target_unicode[260];
} icon_environment_data_block_t;
typedef struct _known_folder_data_block_t
{
uint8_t known_folder_id[16];
uint32_t offset;
} known_folder_data_block_t;
typedef struct _special_folder_data_block_t
{
uint32_t special_folder_id;
uint32_t offset;
} special_folder_data_block_t;
typedef struct _tracker_data_block_t
{
uint32_t length;
uint32_t version;
char machine_id[16];
uint8_t droid_volume_identifier[16];
uint8_t droid_file_identifier[16];
uint8_t droid_birth_volume_identifier[16];
uint8_t droid_birth_file_identifier[16];
} tracker_data_block_t;
#pragma pack(pop)
#define HEADER_SIZE 0x0000004C
#define LINK_CLSID_0 0x00021401
#define LINK_CLSID_1 0x00000000
#define LINK_CLSID_2 0x000000C0
#define LINK_CLSID_3 0x46000000
#define HAS_LINK_TARGET_ID_LIST 0x00000001
#define HAS_LINK_INFO 0x00000002
#define HAS_NAME 0x00000004
#define HAS_RELATIVE_PATH 0x00000008
#define HAS_WORKING_DIR 0x00000010
#define HAS_ARGUMENTS 0x00000020
#define HAS_ICON_LOCATION 0x00000040
#define IS_UNICODE 0x00000080
#define FORCE_NO_LINK_INFO 0x00000100
#define HAS_EXP_STRING 0x00000200
#define RUN_IN_SEPARATE_PROCESS 0x00000400
#define UNUSED_1 0x00000800
#define HAS_DARWIN_ID 0x00001000
#define RUN_AS_USER 0x00002000
#define HAS_EXP_ICON 0x00004000
#define NO_PIDL_ALIAS 0x00008000
#define UNUSED_2 0x00010000
#define RUN_WITH_SHIM_LAYER 0x00020000
#define FORCE_NO_LINK_TRACK 0x00040000
#define ENABLE_TARGET_METADATA 0x00080000
#define DISABLE_LINK_PATH_TRACKING 0x00100000
#define DISABLE_KNOWN_FOLDER_TRACKING 0x00200000
#define DISABLE_KNOWN_FOLDER_ALIAS 0x00400000
#define ALLOW_LINK_TO_LINK 0x00800000
#define UNALIAS_ON_SAVE 0x01000000
#define PREFER_ENVIRONMENT_PATH 0x02000000
#define KEEP_LOCAL_ID_LIST_FOR_UNC_TARGET 0x04000000
#define FILE_ATTRIBUTE_READONLY 0x00000001
#define FILE_ATTRIBUTE_HIDDEN 0x00000002
#define FILE_ATTRIBUTE_SYSTEM 0x00000004
#define RESERVED_1 0x00000008
#define FILE_ATTRIBUTE_DIRECTORY 0x00000010
#define FILE_ATTRIBUTE_ARCHIVE 0x00000020
#define RESERVED_2 0x00000040
#define FILE_ATTRIBUTE_NORMAL 0x00000080
#define FILE_ATTRIBUTE_TEMPORARY 0x00000100
#define FILE_ATTRIBUTE_SPARSE_FILE 0x00000200
#define FILE_ATTRIBUTE_REPARSE_POINT 0x00000400
#define FILE_ATTRIBUTE_COMPRESSED 0x00000800
#define FILE_ATTRIBUTE_OFFLINE 0x00001000
#define FILE_ATTRIBUTE_NOT_CONTENT_INDEXED 0x00002000
#define FILE_ATTRIBUTE_ENCRYPTED 0x00004000
#define SW_SHOWNORMAL 0x00000001
#define SW_SHOWMAXIMIZED 0x00000003
#define SW_SHOWMINNOACTIVE 0x00000007
#define HOTKEYF_SHIFT 0x01
#define HOTKEYF_CONTROL 0x02
#define HOTKEYF_ALT 0x04
#define VOLUME_ID_AND_LOCAL_BASE_PATH 0x01
#define COMMON_NETWORK_RELATIVE_LINK_AND_PATH_SUFFIX 0x02
#define DRIVE_UNKNOWN 0x00
#define DRIVE_NO_ROOT_DIR 0x01
#define DRIVE_REMOVABLE 0x02
#define DRIVE_FIXED 0x03
#define DRIVE_REMOTE 0x04
#define DRIVE_CDROM 0x05
#define DRIVE_RAMDISK 0x06
#define VALID_DEVICE 0x01
#define VALID_NET_TYPE 0x02
#define WNNC_NET_AVID 0x001A0000
#define WNNC_NET_DOCUSPACE 0x001B0000
#define WNNC_NET_MANGOSOFT 0x001C0000
#define WNNC_NET_SERNET 0x001D0000
#define WNNC_NET_RIVERFRONT1 0X001E0000
#define WNNC_NET_RIVERFRONT2 0x001F0000
#define WNNC_NET_DECORB 0x00200000
#define WNNC_NET_PROTSTOR 0x00210000
#define WNNC_NET_FJ_REDIR 0x00220000
#define WNNC_NET_DISTINCT 0x00230000
#define WNNC_NET_TWINS 0x00240000
#define WNNC_NET_RDR2SAMPLE 0x00250000
#define WNNC_NET_CSC 0x00260000
#define WNNC_NET_3IN1 0x00270000
#define WNNC_NET_EXTENDNET 0x00290000
#define WNNC_NET_STAC 0x002A0000
#define WNNC_NET_FOXBAT 0x002B0000
#define WNNC_NET_YAHOO 0x002C0000
#define WNNC_NET_EXIFS 0x002D0000
#define WNNC_NET_DAV 0x002E0000
#define WNNC_NET_KNOWARE 0x002F0000
#define WNNC_NET_OBJECT_DIRE 0x00300000
#define WNNC_NET_MASFAX 0x00310000
#define WNNC_NET_HOB_NFS 0x00320000
#define WNNC_NET_SHIVA 0x00330000
#define WNNC_NET_IBMAL 0x00340000
#define WNNC_NET_LOCK 0x00350000
#define WNNC_NET_TERMSRV 0x00360000
#define WNNC_NET_SRT 0x00370000
#define WNNC_NET_QUINCY 0x00380000
#define WNNC_NET_OPENAFS 0x00390000
#define WNNC_NET_AVID1 0X003A0000
#define WNNC_NET_DFS 0x003B0000
#define WNNC_NET_KWNP 0x003C0000
#define WNNC_NET_ZENWORKS 0x003D0000
#define WNNC_NET_DRIVEONWEB 0x003E0000
#define WNNC_NET_VMWARE 0x003F0000
#define WNNC_NET_RSFX 0x00400000
#define WNNC_NET_MFILES 0x00410000
#define WNNC_NET_MS_NFS 0x00420000
#define WNNC_NET_GOOGLE 0x00430000
#define FOREGROUND_BLUE 0x0001
#define FOREGROUND_GREEN 0x0002
#define FOREGROUND_RED 0x0004
#define FOREGROUND_INTENSITY 0x0008
#define BACKGROUND_BLUE 0x0010
#define BACKGROUND_GREEN 0x0020
#define BACKGROUND_RED 0x0040
#define BACKGROUND_INTENSITY 0x0080
#define FF_DONTCARE 0x0000
#define FF_ROMAN 0x0010
#define FF_SWISS 0x0020
#define FF_MODERN 0x0030
#define FF_SCRIPT 0x0040
#define FF_DECORATIVE 0x0050
#define TMPF_NONE 0x0000
#define TMPF_FIXED_PITCH 0x0001
#define TMPF_VECTOR 0x0002
#define TMPF_TRUETYPE 0x0004
#define TMPF_DEVICE 0x0008
#define CONSOLE_DATA_BLOCK_SIZE 0x000000CC
#define CONSOLE_FE_DATA_BLOCK_SIZE 0x0000000C
#define DARWIN_DATA_BLOCK_SIZE 0x00000314
#define ENVIRONMENT_VARIABLE_DATA_BLOCK_SIZE 0x00000314
#define ICON_ENVIRONMENT_DATA_BLOCK_SIZE 0x00000314
#define KNOWN_FOLDER_DATA_BLOCK_SIZE 0x0000001C
#define PROPERTY_STORE_DATA_BLOCK_MIN_SIZE 0x0000000C
#define SHIM_DATA_BLOCK_MIN_SIZE 0x00000088
#define SPECIAL_FOLDER_DATA_BLOCK_SIZE 0x00000010
#define TRACKER_DATA_BLOCK_SIZE 0x00000060
#define VISTA_AND_ABOVE_ID_LIST_DATA_BLOCK_MIN_SIZE 0x0000000A
#define CONSOLE_DATA_BLOCK_SIGNATURE 0xA0000002
#define CONSOLE_FE_DATA_BLOCK_SIGNATURE 0xA0000004
#define DARWIN_DATA_BLOCK_SIGNATURE 0xA0000006
#define ENVIRONMENT_VARIABLE_DATA_BLOCK_SIGNATURE 0xA0000001
#define ICON_ENVIRONMENT_DATA_BLOCK_SIGNATURE 0xA0000007
#define KNOWN_FOLDER_DATA_BLOCK_SIGNATURE 0xA000000B
#define PROPERTY_STORE_DATA_BLOCK_SIGNATURE 0xA0000009
#define SHIM_DATA_BLOCK_SIGNATURE 0xA0000008
#define SPECIAL_FOLDER_DATA_BLOCK_SIGNATURE 0xA0000005
#define TRACKER_DATA_BLOCK_SIGNATURE 0xA0000003
#define VISTA_AND_ABOVE_ID_LIST_DATA_BLOCK_SIGNATURE 0xA000000C
#endif
libyara/include/yara/lnk_utils.h
+9
View File
@@ -0,0 +1,9 @@
#ifndef YR_LNK_UTILS_H
#define YR_LNK_UTILS_H
#include <yara/lnk.h>
uint64_t convertWindowsTimeToUnixTime(uint64_t input);
char* get_hotkey_char(uint8_t key);
#endif
libyara/modules/lnk/lnk.c
+2391
View File
File diff suppressed because it is too large Load Diff
libyara/modules/lnk/lnk_utils.c
+277
View File
@@ -0,0 +1,277 @@
#include <stdio.h>
#include <string.h>
#include <yara/endian.h>
#include <yara/integers.h>
#include <yara/lnk.h>
#include <yara/lnk_utils.h>
#include <yara/mem.h>
#include <yara/strutils.h>
#include <yara/utils.h>
uint64_t convertWindowsTimeToUnixTime(uint64_t input)
{
// https://stackoverflow.com/questions/6161776/convert-windows-filetime-to-second-in-unix-linux
long long int temp;
temp = input / TICKS_PER_SECOND; // convert from 100ns intervals to seconds;
temp = temp - EPOCH_DIFFERENCE; // subtract number of seconds between epochs
return temp;
}
char* get_hotkey_char(uint8_t key)
{
char key_str[64];
key_str[0] = '\0';
switch (key)
{
case 0x30:
sprintf(key_str, "0");
break;
case 0x31:
sprintf(key_str, "1");
break;
case 0x32:
sprintf(key_str, "2");
break;
case 0x33:
sprintf(key_str, "3");
break;
case 0x34:
sprintf(key_str, "4");
break;
case 0x35:
sprintf(key_str, "5");
break;
case 0x36:
sprintf(key_str, "6");
break;
case 0x37:
sprintf(key_str, "7");
break;
case 0x38:
sprintf(key_str, "8");
break;
case 0x39:
sprintf(key_str, "9");
break;
case 0x41:
sprintf(key_str, "A");
break;
case 0x42:
sprintf(key_str, "B");
break;
case 0x43:
sprintf(key_str, "C");
break;
case 0x44:
sprintf(key_str, "D");
break;
case 0x45:
sprintf(key_str, "E");
break;
case 0x46:
sprintf(key_str, "F");
break;
case 0x47:
sprintf(key_str, "G");
break;
case 0x48:
sprintf(key_str, "H");
break;
case 0x49:
sprintf(key_str, "I");
break;
case 0x4A:
sprintf(key_str, "J");
break;
case 0x4B:
sprintf(key_str, "K");
break;
case 0x4C:
sprintf(key_str, "L");
break;
case 0x4D:
sprintf(key_str, "M");
break;
case 0x4E:
sprintf(key_str, "N");
break;
case 0x4F:
sprintf(key_str, "O");
break;
case 0x50:
sprintf(key_str, "P");
break;
case 0x51:
sprintf(key_str, "Q");
break;
case 0x52:
sprintf(key_str, "R");
break;
case 0x53:
sprintf(key_str, "S");
break;
case 0x54:
sprintf(key_str, "T");
break;
case 0x55:
sprintf(key_str, "U");
break;
case 0x56:
sprintf(key_str, "V");
break;
case 0x57:
sprintf(key_str, "W");
break;
case 0x58:
sprintf(key_str, "X");
break;
case 0x59:
sprintf(key_str, "Y");
break;
case 0x5A:
sprintf(key_str, "Z");
break;
case 0x70:
sprintf(key_str, "F1");
break;
case 0x71:
sprintf(key_str, "F2");
break;
case 0x72:
sprintf(key_str, "F3");
break;
case 0x73:
sprintf(key_str, "F4");
break;
case 0x74:
sprintf(key_str, "F5");
break;
case 0x75:
sprintf(key_str, "F6");
break;
case 0x76:
sprintf(key_str, "F7");
break;
case 0x77:
sprintf(key_str, "F8");
break;
case 0x78:
sprintf(key_str, "F9");
break;
case 0x79:
sprintf(key_str, "F10");
break;
case 0x7A:
sprintf(key_str, "F11");
break;
case 0x7B:
sprintf(key_str, "F12");
break;
case 0x7C:
sprintf(key_str, "F13");
break;
case 0x7D:
sprintf(key_str, "F14");
break;
case 0x7E:
sprintf(key_str, "F15");
break;
case 0x7F:
sprintf(key_str, "F16");
break;
case 0x80:
sprintf(key_str, "F17");
break;
case 0x81:
sprintf(key_str, "F18");
break;
case 0x82:
sprintf(key_str, "F19");
break;
case 0x83:
sprintf(key_str, "F20");
break;
case 0x84:
sprintf(key_str, "F21");
break;
case 0x85:
sprintf(key_str, "F22");
break;
case 0x86:
sprintf(key_str, "F23");
break;
case 0x87:
sprintf(key_str, "F24");
break;
case 0x90:
sprintf(key_str, "NUM LOCK");
break;
case 0x91:
sprintf(key_str, "SCROLL LOCK");
break;
}
return yr_strdup(key_str);
}
libyara/modules/module_list
+2 -1
View File
@@ -5,6 +5,7 @@ MODULE(math)
MODULE(time)
MODULE(console)
MODULE(string)
MODULE(lnk)
#ifdef DOTNET_MODULE
MODULE(dotnet)
@@ -32,4 +33,4 @@ MODULE(dex)
#ifdef PB_TESTS_MODULE
MODULE(pb_tests)
#endif
#endif
tests/BUILD.bazel
+19
View File
@@ -278,3 +278,22 @@ cc_test(
"@//:libyara",
],
)
cc_test(
name = "test_lnk",
srcs = ["test-lnk.c"],
copts = COPTS,
data = [
"data/lnk-standard",
"data/lnk-extradata-1",
"data/lnk-extradata-2",
"data/lnk-malformed",
"data/lnk-network",
"data/lnk-overlay",
],
linkstatic = True,
deps = [
":util",
"@//:libyara",
],
)
tests/data/lnk-extradata-1
BIN
View File
Binary file not shown.
tests/data/lnk-extradata-2
BIN
View File
Binary file not shown.
tests/data/lnk-malformed
BIN
View File
Binary file not shown.
tests/data/lnk-network
BIN
View File
Binary file not shown.
tests/data/lnk-overlay
BIN
View File
Binary file not shown.
tests/data/lnk-standard
BIN
View File
Binary file not shown.
tests/test-lnk.c
+505
View File
@@ -0,0 +1,505 @@
#include <stdio.h>
#include <stdlib.h>
#include <yara.h>
#include "util.h"
int main(int argc, char** argv)
{
int result = 0;
YR_DEBUG_INITIALIZE();
YR_DEBUG_FPRINTF(1, stderr, "+ %s() { // in %s\n", __FUNCTION__, argv[0]);
init_top_srcdir();
yr_initialize();
assert_true_rule_file(
"import \"lnk\" \
rule is_lnk { \
condition: \
lnk.is_lnk \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule creation_time { \
condition: \
lnk.creation_time == 1221251237 \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule access_time { \
condition: \
lnk.access_time == 1221251237 \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule write_time { \
condition: \
lnk.write_time == 1221251237 \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule has_link_target_id_list { \
condition: \
lnk.link_flags & lnk.HAS_LINK_TARGET_ID_LIST \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule has_link_info { \
condition: \
lnk.link_flags & lnk.HAS_LINK_INFO \
}",
"tests/data/lnk-standard");
assert_false_rule_file(
"import \"lnk\" \
rule has_name { \
condition: \
lnk.link_flags & lnk.HAS_NAME \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule file_attribute_archive { \
condition: \
lnk.file_attributes_flags & lnk.FILE_ATTRIBUTE_ARCHIVE \
}",
"tests/data/lnk-standard");
assert_false_rule_file(
"import \"lnk\" \
rule file_attribute_readonly { \
condition: \
lnk.file_attributes_flags & lnk.FILE_ATTRIBUTE_READONLY \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule show_command { \
condition: \
lnk.show_command == lnk.SW_SHOWNORMAL \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule no_hotkey { \
condition: \
not lnk.has_hotkey and not defined lnk.hotkey \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule item_id_list_size { \
condition: \
lnk.link_target_id_list.item_id_list_size == 0xBD \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule number_of_item_ids { \
condition: \
lnk.link_target_id_list.number_of_item_ids == 4 \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule item_id_first_element { \
condition: \
lnk.link_target_id_list.item_id_list[0].size == 0x12 and lnk.link_target_id_list.item_id_list[0].data == \"\\x1fP\\xe0O\\xd0 \\xea:i\\x10\\xa2\\xd8\\x08\\x00+00\\x9d\" \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule item_id_first_element { \
condition: \
lnk.link_target_id_list.item_id_list[3].size == 0x46 and lnk.link_target_id_list.item_id_list[3].data == \"2\\x00\\x00\\x00\\x00\\x00,9i\\xa3 \\x00a.txt\\x004\\x00\\x07\\x00\\x04\\x00\\xef\\xbe,9i\\xa3,9i\\xa3&\\x00\\x00\\x00-n\\x00\\x00\\x00\\x00\\x96\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00a\\x00.\\x00t\\x00x\\x00t\\x00\\x00\\x00\\x14\\x00\" \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule link_info_size { \
condition: \
lnk.link_info.size == 0x3C \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule link_info_header_size { \
condition: \
lnk.link_info.header_size == 0x1C \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule link_info_flags { \
condition: \
lnk.link_info.flags & lnk.VOLUME_ID_AND_LOCAL_BASE_PATH \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule volume_id_offset { \
condition: \
lnk.link_info.volume_id_offset == 0x1C \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule has_volume_id { \
condition: \
lnk.link_info.has_volume_id \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule local_base_path_offset { \
condition: \
lnk.link_info.local_base_path_offset == 0x2D \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule common_network_relative_link_offset { \
condition: \
lnk.link_info.common_network_relative_link_offset == 0 \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule common_path_suffix_offset { \
condition: \
lnk.link_info.common_path_suffix_offset == 0x3B \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule volume_id_size { \
condition: \
lnk.link_info.volume_id.size == 17 \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule drive_type { \
condition: \
lnk.link_info.volume_id.drive_type & lnk.DRIVE_FIXED \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule drive_serial_number { \
condition: \
lnk.link_info.volume_id.drive_serial_number == 0x307A8A81 \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule volume_label_offset { \
condition: \
lnk.link_info.volume_id.volume_label_offset == 0x10 \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule volume_id_data { \
condition: \
lnk.link_info.volume_id.data == \"\\x00\" \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule local_base_path { \
condition: \
lnk.link_info.local_base_path == \"C:\\\\test\\\\a.txt\" \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule common_path_suffix { \
condition: \
lnk.link_info.common_path_suffix == \"\\x00\" \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule relative_path { \
condition: \
lnk.relative_path == \".\\x00\\\\\\x00a\\x00.\\x00t\\x00x\\x00t\\x00\" \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule working_dir { \
condition: \
lnk.working_dir == \"C\\x00:\\x00\\\\\\x00t\\x00e\\x00s\\x00t\\x00\" \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule has_tracker_data { \
condition: \
lnk.has_tracker_data \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule tracker_data_block_size { \
condition: \
lnk.tracker_data.block_size == 0x60 \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule tracker_data_block_signature { \
condition: \
lnk.tracker_data.block_signature == 0xA0000003 \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule machine_id { \
condition: \
lnk.tracker_data.machine_id == \"chris-xps\" \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule droid_volume_identifier { \
condition: \
lnk.tracker_data.droid_volume_identifier == \"\\x40\\x78\\xC7\\x94\\x47\\xFA\\xC7\\x46\\xB3\\x56\\x5C\\x2D\\xC6\\xB6\\xD1\\x15\" \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule droid_file_identifier { \
condition: \
lnk.tracker_data.droid_file_identifier == \"\\xEC\\x46\\xCD\\x7B\\x22\\x7F\\xDD\\x11\\x94\\x99\\x00\\x13\\x72\\x16\\x87\\x4A\" \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule droid_birth_volume_identifier { \
condition: \
lnk.tracker_data.droid_birth_volume_identifier == \"\\x40\\x78\\xC7\\x94\\x47\\xFA\\xC7\\x46\\xB3\\x56\\x5C\\x2D\\xC6\\xB6\\xD1\\x15\" \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule droid_birth_file_identifier { \
condition: \
lnk.tracker_data.droid_birth_file_identifier == \"\\xEC\\x46\\xCD\\x7B\\x22\\x7F\\xDD\\x11\\x94\\x99\\x00\\x13\\x72\\x16\\x87\\x4A\" \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule common_network_relative_link_flags { \
condition: \
lnk.link_info.common_network_relative_link.flags & lnk.VALID_NET_TYPE \
}",
"tests/data/lnk-network");
assert_true_rule_file(
"import \"lnk\" \
rule net_name { \
condition: \
lnk.link_info.common_network_relative_link.net_name == \"\\\\\\\\localhost\\\\c$\\\\Users\\\\yarac\\\\Documents\\\\testing\" \
}",
"tests/data/lnk-network");
assert_true_rule_file(
"import \"lnk\" \
rule device_name { \
condition: \
lnk.link_info.common_network_relative_link.device_name == \"Z:\" \
}",
"tests/data/lnk-network");
// VolumeID has been set from 0x11 to an impossibly large value 0xFFFFFFFF
assert_true_rule_file(
"import \"lnk\" \
rule malformed_lnk { \
condition: \
lnk.is_malformed \
}",
"tests/data/lnk-malformed");
assert_true_rule_file(
"import \"lnk\" \
rule overlay_lnk { \
condition: \
lnk.has_overlay and lnk.overlay_offset == 0x1CB \
}",
"tests/data/lnk-overlay");
assert_true_rule_file(
"import \"lnk\" \
rule has_console_data { \
condition: \
lnk.has_console_data \
}",
"tests/data/lnk-extradata-1");
assert_true_rule_file(
"import \"lnk\" \
rule number_of_history_buffers { \
condition: \
lnk.console_data.number_of_history_buffers == 4 \
}",
"tests/data/lnk-extradata-1");
assert_true_rule_file(
"import \"lnk\" \
rule color_table { \
condition: \
lnk.console_data.color_table[15] == 0x00ffffff \
}",
"tests/data/lnk-extradata-1");
assert_true_rule_file(
"import \"lnk\" \
rule screen_buffer_size { \
condition: \
lnk.console_data.screen_buffer_size_x == 120 and lnk.console_data.screen_buffer_size_y == 3000 \
}",
"tests/data/lnk-extradata-1");
assert_true_rule_file(
"import \"lnk\" \
rule window_size { \
condition: \
lnk.console_data.window_size_x == 120 and lnk.console_data.window_size_y == 50 \
}",
"tests/data/lnk-extradata-1");
assert_true_rule_file(
"import \"lnk\" \
rule window_origin { \
condition: \
lnk.console_data.window_origin_x == 0 and lnk.console_data.window_origin_y == 0 \
}",
"tests/data/lnk-extradata-1");
assert_true_rule_file(
"import \"lnk\" \
rule has_environment_variable_data { \
condition: \
lnk.has_environment_variable_data \
}",
"tests/data/lnk-extradata-1");
assert_true_rule_file(
"import \"lnk\" \
rule environment_variable_data_ansi { \
condition: \
lnk.environment_variable_data.target_ansi == \"%SystemRoot%\\\\sysWOW64\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\" \
}",
"tests/data/lnk-extradata-1");
assert_true_rule_file(
"import \"lnk\" \
rule has_special_folder_data { \
condition: \
lnk.has_special_folder_data \
}",
"tests/data/lnk-extradata-1");
assert_true_rule_file(
"import \"lnk\" \
rule special_folder_data { \
condition: \
lnk.special_folder_data.special_folder_id == 36 and lnk.special_folder_data.offset == 105 \
}",
"tests/data/lnk-extradata-1");
assert_true_rule_file(
"import \"lnk\" \
rule icon_environment_data_target_ansi { \
condition: \
lnk.icon_environment_data.target_ansi == \"%ProgramFiles%\\\\PeaZip\\\\res\\\\icons\\\\peazip_new.icl\" \
}",
"tests/data/lnk-extradata-2");
assert_true_rule_file(
"import \"lnk\" \
rule has_icon_environment_data { \
condition: \
lnk.has_icon_environment_data \
}",
"tests/data/lnk-extradata-2");
assert_true_rule_file(
"import \"lnk\" \
rule has_known_folder_data { \
condition: \
lnk.has_known_folder_data \
}",
"tests/data/lnk-extradata-2");
assert_true_rule_file(
"import \"lnk\" \
rule known_folder_offset { \
condition: \
lnk.known_folder_data.offset == 177 \
}",
"tests/data/lnk-extradata-2");
assert_true_rule_file(
"import \"lnk\" \
rule known_folder_id { \
condition: \
lnk.known_folder_data.known_folder_id[15] == 142 \
}",
"tests/data/lnk-extradata-2");
yr_finalize();
YR_DEBUG_FPRINTF(
1, stderr, "} = %d // %s() in %s\n", result, __FUNCTION__, argv[0]);
return result;
}
windows/vs2015/libyara/libyara.vcxproj
+2
View File
@@ -244,6 +244,8 @@
<ClCompile Include="..\..\..\libyara\modules\dotnet\dotnet.c" />
<ClCompile Include="..\..\..\libyara\modules\elf\elf.c" />
<ClCompile Include="..\..\..\libyara\modules\hash\hash.c" />
<ClCompile Include="..\..\..\libyara\modules\lnk\lnk.c" />
<ClCompile Include="..\..\..\libyara\modules\lnk\lnk_utils.c" />
<ClCompile Include="..\..\..\libyara\modules\math\math.c" />
<ClCompile Include="..\..\..\libyara\modules\macho\macho.c" />
<ClCompile Include="..\..\..\libyara\modules\pe\pe.c" />
windows/vs2017/libyara/libyara.vcxproj
+2
View File
@@ -243,6 +243,8 @@
<ClCompile Include="..\..\..\libyara\modules\dotnet\dotnet.c" />
<ClCompile Include="..\..\..\libyara\modules\elf\elf.c" />
<ClCompile Include="..\..\..\libyara\modules\hash\hash.c" />
<ClCompile Include="..\..\..\libyara\modules\lnk\lnk.c" />
<ClCompile Include="..\..\..\libyara\modules\lnk\lnk_utils.c" />
<ClCompile Include="..\..\..\libyara\modules\math\math.c" />
<ClCompile Include="..\..\..\libyara\modules\macho\macho.c" />
<ClCompile Include="..\..\..\libyara\modules\pe\pe.c" />