VirusTotal/yara
1
0
Fork 0
mirror of https://github.com/VirusTotal/yara.git synced 2026-10-12 02:10:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix #1671

Browse Source 
iterator->last_error is now initialized to ERROR_SUCCESS in yr_process_open_iterator. Additionally if yr_process_get_first_memory_block returns, NULL, iterator->last_error is set to ERROR_COULD_NOT_READ_PROCESS_MEMORY.
This commit is contained in:
Victor M. Alvarez
2022-04-05 13:07:41 +02:00
parent 695ede3d2d
commit bf200a2fa1
6 changed files with 36 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libyara/proc.c
+2
View File
@@ -54,6 +54,8 @@ YR_API int yr_process_open_iterator(int pid, YR_MEMORY_BLOCK_ITERATOR* iterator)
iterator->context = context;
iterator->first = yr_process_get_first_memory_block;
iterator->next = yr_process_get_next_memory_block;
iterator->last_error = ERROR_SUCCESS;
// In a process scan file size is undefined, when the file_size function is
// set to NULL the value returned by the filesize keyword is YR_UNDEFINED.
iterator->file_size = NULL;
libyara/proc/freebsd.c
+8 -3
View File
@@ -138,8 +138,6 @@ YR_API YR_MEMORY_BLOCK* yr_process_get_next_memory_block(
proc_info->vm_entry.pve_path = buf;
proc_info->vm_entry.pve_pathlen = sizeof(buf);
iterator->last_error = ERROR_SUCCESS;
uint64_t current_begin = context->current_block.base +
context->current_block.size;
@@ -148,6 +146,8 @@ YR_API YR_MEMORY_BLOCK* yr_process_get_next_memory_block(
yr_get_configuration_uint64(
YR_CONFIG_MAX_PROCESS_MEMORY_CHUNK, &max_process_memory_chunk);
iterator->last_error = ERROR_SUCCESS;
if (proc_info->vm_entry.pve_end <= current_begin)
{
if (ptrace(
@@ -180,7 +180,12 @@ YR_API YR_MEMORY_BLOCK* yr_process_get_first_memory_block(
proc_info->vm_entry.pve_entry = 0;
return yr_process_get_next_memory_block(iterator);
YR_MEMORY_BLOCK* result = yr_process_get_next_memory_block(iterator);
if (result == NULL)
iterator->last_error = ERROR_COULD_NOT_READ_PROCESS_MEMORY;
return result;
}
#endif
libyara/proc/linux.c
+6 -3
View File
@@ -312,8 +312,8 @@ YR_API YR_MEMORY_BLOCK* yr_process_get_next_memory_block(
char buffer[PATH_MAX];
char perm[5];
uint64_t begin, end;
uint64_t begin, end;
uint64_t current_begin = context->current_block.base +
context->current_block.size;
@@ -322,6 +322,8 @@ YR_API YR_MEMORY_BLOCK* yr_process_get_next_memory_block(
yr_get_configuration_uint64(
YR_CONFIG_MAX_PROCESS_MEMORY_CHUNK, &max_process_memory_chunk);
iterator->last_error = ERROR_SUCCESS;
if (proc_info->next_block_end <= current_begin)
{
int path_start, n = 0;
@@ -399,8 +401,6 @@ YR_API YR_MEMORY_BLOCK* yr_process_get_next_memory_block(
assert(context->current_block.size > 0);
iterator->last_error = ERROR_SUCCESS;
YR_DEBUG_FPRINTF(
2,
stderr,
@@ -434,6 +434,9 @@ YR_API YR_MEMORY_BLOCK* yr_process_get_first_memory_block(
_exit:
if (result == NULL)
iterator->last_result = ERROR_COULD_NOT_READ_PROCESS_MEMORY;
YR_DEBUG_FPRINTF(2, stderr, "} = %p // %s()\n", result, __FUNCTION__);
return result;
libyara/proc/mach.c
+6 -1
View File
@@ -175,7 +175,12 @@ YR_API YR_MEMORY_BLOCK* yr_process_get_first_memory_block(
context->current_block.base = 0;
context->current_block.size = 0;
return yr_process_get_next_memory_block(iterator);
YR_MEMORY_BLOCK* result = yr_process_get_next_memory_block(iterator);
if (result == NULL)
iterator->last_error = ERROR_COULD_NOT_READ_PROCESS_MEMORY;
return result;
}
#endif
libyara/proc/openbsd.c
+8 -3
View File
@@ -150,8 +150,6 @@ YR_API YR_MEMORY_BLOCK* yr_process_get_next_memory_block(
int mib[] = {CTL_KERN, KERN_PROC_VMMAP, proc_info->pid};
size_t len = sizeof(struct kinfo_vmentry);
iterator->last_error = ERROR_SUCCESS;
uint64_t current_begin = context->current_block.base +
context->current_block.size;
@@ -160,6 +158,8 @@ YR_API YR_MEMORY_BLOCK* yr_process_get_next_memory_block(
yr_get_configuration_uint64(
YR_CONFIG_MAX_PROCESS_MEMORY_CHUNK, &max_process_memory_chunk);
iterator->last_error = ERROR_SUCCESS;
if (proc_info->old_end <= current_begin)
{
if (sysctl(mib, 3, &proc_info->vm_entry, &len, NULL, 0) < 0)
@@ -192,7 +192,12 @@ YR_API YR_MEMORY_BLOCK* yr_process_get_first_memory_block(
proc_info->vm_entry.kve_start = 0;
return yr_process_get_next_memory_block(iterator);
YR_MEMORY_BLOCK* result = yr_process_get_next_memory_block(iterator);
if (result == NULL)
iterator->last_error = ERROR_COULD_NOT_READ_PROCESS_MEMORY;
return result;
}
#endif
libyara/proc/windows.c
+6 -1
View File
@@ -185,7 +185,12 @@ YR_API YR_MEMORY_BLOCK* yr_process_get_first_memory_block(
context->current_block.base = (size_t)
proc_info->si.lpMinimumApplicationAddress;
return yr_process_get_next_memory_block(iterator);
YR_MEMORY_BLOCK* result = yr_process_get_next_memory_block(iterator);
if (result == NULL)
iterator->last_error = ERROR_COULD_NOT_READ_PROCESS_MEMORY;
return result;
}
#endif