VirusTotal/yara
1
0
Fork 0
mirror of https://github.com/VirusTotal/yara.git synced 2026-10-12 02:10:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Revert "LNK module (#1732)"

Browse Source 
This reverts commit 97fd691086.
This commit is contained in:
John
2023-08-24 09:55:14 +02:00
committed by Victor M. Alvarez
parent 97fd691086
commit c41906bb13
21 changed files with 3 additions and 4261 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
-3
View File
@@ -90,6 +90,3 @@ windows/*/packages/
.vscode/
tests/mapper
# Sphinx build
/docs/_build/*
BUILD.bazel
-3
View File
@@ -80,7 +80,6 @@ yara_library(
"time",
"console",
"string",
"lnk",
],
modules_srcs = [
"libyara/modules/cuckoo/cuckoo.c",
@@ -97,8 +96,6 @@ yara_library(
"libyara/modules/time/time.c",
"libyara/modules/console/console.c",
"libyara/modules/string/string.c",
"libyara/modules/lnk/lnk.c",
"libyara/modules/lnk/lnk_utils.c",
],
deps = [
"@jansson",
Makefile.am
+1 -10
View File
@@ -98,9 +98,6 @@ MODULES += libyara/modules/console/console.c
MODULES += libyara/modules/string/string.c
MODULES += libyara/modules/lnk/lnk.c
MODULES += libyara/modules/lnk/lnk_utils.c
if CUCKOO_MODULE
MODULES += libyara/modules/cuckoo/cuckoo.c
endif
@@ -195,8 +192,6 @@ noinst_HEADERS = \
libyara/include/yara/pe.h \
libyara/include/yara/pe_utils.h \
libyara/include/yara/re_lexer.h \
libyara/include/yara/lnk.h \
libyara/include/yara/lnk_utils.h \
libyara/modules/module_list
dist_noinst_DATA = libyara/pb/yara.proto
@@ -353,9 +348,6 @@ test_re_split_LDFLAGS = -static
test_async_SOURCES = tests/test-async.c tests/util.c
test_async_LDADD = libyara.la
test_async_LDFLAGS = -static
test_lnk_SOURCES = tests/test-lnk.c tests/util.c
test_lnk_LDADD = libyara.la
test_lnk_LDFLAGS = -static
TESTS = $(check_PROGRAMS)
TESTS_ENVIRONMENT = TOP_SRCDIR=$(top_srcdir) TOP_BUILDDIR=$(top_builddir)
@@ -374,8 +366,7 @@ check_PROGRAMS = \
test-stack \
test-re-split \
test-async \
test-string \
test-lnk
test-string
EXTRA_PROGRAMS = tests/mapper
CLEANFILES = tests/mapper$(EXEEXT)
bazel/yara.bzl
-2
View File
@@ -171,8 +171,6 @@ def yara_library(
"libyara/include/yara/lexer.h",
"libyara/include/yara/libyara.h",
"libyara/include/yara/limits.h",
"libyara/include/yara/lnk.h",
"libyara/include/yara/lnk_utils.h",
"libyara/include/yara/macho.h",
"libyara/include/yara/mem.h",
"libyara/include/yara/modules.h",
docs/modules.rst
+1 -1
View File
@@ -22,6 +22,6 @@ modules in the :ref:`writing-modules` section.
Time <modules/time>
Console <modules/console>
String <modules/string>
LNK <modules/lnk>
docs/modules/lnk.rst
-741
View File
@@ -1,741 +0,0 @@
.. _lnk-module:
##########
LNK module
##########
The LNK module allows you to create more fine-grained rules for LNK files by
using attributes and features of the LNK file format. This module exposes most of
the fields present in an LNK file. Let's see some examples:
.. code-block:: yara
import "lnk"
rule is_lnk
{
condition:
lnk.is_lnk
}
rule machine_id_tracking
{
condition:
lnk.tracker_data.machine_id == "chris-xps"
}
rule local_base_path
{
condition:
lnk.link_info.local_base_path == "C:\\test\\a.txt"
}
The LNK documentation can be found on Microsoft's website:
https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-shllink/16cb4ca1-9339-4d0c-a68d-bf1d6cc0f943
Reference
---------
.. c:type:: is_lnk
Return true if the file is an LNK.
*Example: lnk.is_lnk*
.. c:type:: creation_time
An epoch integer that specifies the creation time (UTC) of the link target
*Example: lnk.creation_time == 1221247637*
.. c:type:: access_time
An epoch integer that specifies the access time (UTC) of the link target
*Example: lnk.access_time == 1221247637*
.. c:type:: write_time
An epoch integer that specifies the write time (UTC) of the link target
*Example: lnk.write_time == 1221247637*
.. c:type:: file_size
An unsigned integer that specifies the size, in bytes, of the link target
*Example: lnk.file_size > 100KB*
.. c:type:: link_flags
The LinkFlags value specifies information about the shell link and the presence of optional portions of the LNK file. Values can be checked by performing a bitwise AND operation with the following constants:
.. c:member:: HAS_LINK_TARGET_ID_LIST
.. c:member:: HAS_LINK_INFO
.. c:member:: HAS_NAME
.. c:member:: HAS_RELATIVE_PATH
.. c:member:: HAS_WORKING_DIR
.. c:member:: HAS_ARGUMENTS
.. c:member:: HAS_ICON_LOCATION
.. c:member:: IS_UNICODE
.. c:member:: FORCE_NO_LINK_INFO
.. c:member:: HAS_EXP_STRING
.. c:member:: RUN_IN_SEPARATE_PROCESS
.. c:member:: UNUSED_1
.. c:member:: HAS_DARWIN_ID
.. c:member:: RUN_AS_USER
.. c:member:: HAS_EXP_ICON
.. c:member:: NO_PIDL_ALIAS
.. c:member:: UNUSED_2
.. c:member:: RUN_WITH_SHIM_LAYER
.. c:member:: FORCE_NO_LINK_TRACK
.. c:member:: ENABLE_TARGET_METADATA
.. c:member:: DISABLE_LINK_PATH_TRACKING
.. c:member:: DISABLE_KNOWN_FOLDER_TRACKING
.. c:member:: DISABLE_KNOWN_FOLDER_ALIAS
.. c:member:: ALLOW_LINK_TO_LINK
.. c:member:: UNALIAS_ON_SAVE
.. c:member:: PREFER_ENVIRONMENT_PATH
.. c:member:: KEEP_LOCAL_ID_LIST_FOR_UNC_TARGET
*Example: lnk.link_flags & lnk.HAS_LINK_INFO*
.. c:type:: file_attributes_flags
A file attributes flag that specifies information about the link target. Values can be checked by performing a bitwise AND operation with the following constants:
.. c:member:: FILE_ATTRIBUTE_READONLY
.. c:member:: FILE_ATTRIBUTE_HIDDEN
.. c:member:: FILE_ATTRIBUTE_SYSTEM
.. c:member:: RESERVED_1
.. c:member:: FILE_ATTRIBUTE_DIRECTORY
.. c:member:: FILE_ATTRIBUTE_ARCHIVE
.. c:member:: RESERVED_2
.. c:member:: FILE_ATTRIBUTE_NORMAL
.. c:member:: FILE_ATTRIBUTE_TEMPORARY
.. c:member:: FILE_ATTRIBUTE_SPARSE_FILE
.. c:member:: FILE_ATTRIBUTE_REPARSE_POINT
.. c:member:: FILE_ATTRIBUTE_COMPRESSED
.. c:member:: FILE_ATTRIBUTE_OFFLINE
.. c:member:: FILE_ATTRIBUTE_NOT_CONTENT_INDEXED
.. c:member:: FILE_ATTRIBUTE_ENCRYPTED
*Example: lnk.file_attributes_flags & lnk.FILE_ATTRIBUTE_READONLY*
.. c:type:: icon_index
An integer that specifies the index of an icon within a given icon location.
.. c:type:: show_command
An unsigned integer that specifies the expected window state of an application launched by the link. This value should be equal to one of the following:
.. c:member:: FILE_ATTRIBUTE_READONLY
.. c:member:: FILE_ATTRIBUTE_HIDDEN
.. c:member:: FILE_ATTRIBUTE_SYSTEM
*Example: lnk.show_command == lnk.SW_SHOWNORMAL*
.. c:type:: has_hotkey
Boolean value to indicate whether a hotkey is present for the LNK file.
*Example: lnk.has_hotkey*
.. c:type:: hotkey_flags
Flags that detail the hotkey that's present (if applicable), and modifiers for how it should operate.
.. c:type:: hotkey
A string representing the hotkey that is assigned to launch the LNK.
*Example: lnk.hotkey == "F5"*
.. c:type:: hotkey_modifier_flags
An unsigned integer that specifies bits that correspond to modifier keys on the keyboard. This value must be one or a combination of the following:
.. c:member:: HOTKEYF_SHIFT
.. c:member:: HOTKEYF_CONTROL
.. c:member:: HOTKEYF_ALT
*Example: lnk.hotkey_modifier_flags & lnk.HOTKEYF_SHIFT*
.. c:type:: link_target_id_list
An optional structure that specifies the target of the link.
.. c:member:: number_of_item_ids
The number of ItemIDs within the list.
*Example: lnk.link_target_id_list.number_of_item_ids == 4*
.. c:member:: item_id_list_size
The size of the ItemID list.
*Example: lnk.link_target_id_list.item_id_list_size == 0xBD*
.. c:type:: item_id_list
A zero-based array of ItemIDs structures. The data stored in a given ItemID is defined by the source that corresponds to the location in the target namespace of the preceding ItemIDs. This data uniquely identifies the items in that part of the namespace. Each ItemID has the following members:
.. c:member:: data
The shell data source-defined data that specifies an item.
*Example: lnk.link_target_id_list.item_id_list[0].data == "\\x1fP\\xe0O\\xd0 \\xea:i\\x10\\xa2\\xd8\\x08\\x00+00\\x9d"*
.. c:member:: size
The size of the ItemID.
*Example: lnk.link_target_id_list.item_id_list[0].size == 0x12*
.. c:type:: link_info
The LinkInfo structure provides information necessary to resolve a link target if it is not found in its original location.
.. c:member:: size
An unsigned integer that specifies the size, in bytes, of the LinkInfo structure. All offsets specified in this structure MUST be less than this value, and all strings contained in this structure MUST fit within the extent defined by this size.
*Example: lnk.link_info.size == 0x3C*
.. c:member:: header_size
An unsigned integer that specifies the size, in bytes, of the LinkInfo header section. Note that if the value is 0x1C, then offsets to some optional fields (local_base_path_offset_unicode and common_path_suffix_offset_unicode) will not be set.
*Example: lnk.link_info.header_size == 0x1C*
.. c:member:: flags
Flags that specify whether the VolumeID, LocalBasePath, LocalBasePathUnicode, and CommonNetworkRelativeLink fields are present in this structure. Values can be checked by performing a bitwise AND operation with the following constants:
.. c:member:: VOLUME_ID_AND_LOCAL_BASE_PATH
.. c:member:: COMMON_NETWORK_RELATIVE_LINK_AND_PATH_SUFFIX
*Example: lnk.link_info.flags & lnk.VOLUME_ID_AND_LOCAL_BASE_PATH*
.. c:member:: volume_id_offset
An unsigned integer that specifies the location of the VolumeID field.
*Example: lnk.link_info.volume_id_offset == 0x1C*
.. c:member:: local_base_path_offset
An unsigned integer that specifies the location of the LocalBasePath field.
*Example: lnk.link_info.local_base_path_offset == 0x2D*
.. c:member:: common_network_relative_link_offset
An unsigned integer that specifies the location of the CommonNetworkRelativeLink field.
.. c:member:: common_path_suffix_offset
An unsigned integer that specifies the location of the CommonPathSuffix field.
.. c:member:: local_base_path_offset_unicode
An optional unsigned integer that specifies the location of the LocalBasePathUnicode field.
.. c:member:: common_path_suffix_offset_unicode
An optional unsigned integer that specifies the location of the CommonPathSuffixUnicode field.
.. c:type:: has_volume_id
Boolean flag which is set if a VolumeID structure is present.
*Example: lnk.link_info.has_volume_id*
.. c:type:: volume_id
An optional VolumeID structure (section 2.3.1) that specifies information about the volume that the link target was on when the link was created.
.. c:member:: size
The size of the structure.
.. c:member:: drive_type
An unsigned integer that specifies the type of drive the link target is stored on. It must be equal to one of the following:
.. c:member:: DRIVE_UNKNOWN
.. c:member:: DRIVE_NO_ROOT_DIR
.. c:member:: DRIVE_REMOVABLE
.. c:member:: DRIVE_FIXED
.. c:member:: DRIVE_REMOTE
.. c:member:: DRIVE_CDROM
.. c:member:: DRIVE_RAMDISK
*Example: lnk.link_info.volume_id.drive_type & lnk.DRIVE_FIXED*
.. c:member:: drive_serial_number
An unsigned integer that specifies the drive serial number of the volume the link target is stored on.
*Example: lnk.link_info.volume_id.drive_serial_number == 0x307A8A81*
.. c:member:: volume_label_offset
An unsigned integer that specifies the location of a string that contains the volume label of the drive that the link target is stored on.
.. c:member:: volume_label_offset_unicode
An optional unsigned integer that specifies the location of a string that contains the volume label of the drive that the link target is stored on.
.. c:member:: data
A buffer of data that contains the volume label of the drive as a string defined by the system default code page or Unicode characters, as specified by preceding fields.
*Example: lnk.link_info.volume_id.data == "\\x00"*
.. c:member:: local_base_path
An optional, NULL–terminated string, defined by the system default code page, which is used to construct the full path to the link item or link target by appending the string in the CommonPathSuffix field.
*Example: lnk.link_info.local_base_path == "C:\\test\\a.txt"*
.. c:type:: common_network_relative_link
The CommonNetworkRelativeLink structure specifies information about the network location where a link target is stored, including the mapped drive letter and the UNC path prefix.
.. c:member:: size
The size of the structure.
.. c:member:: flags
Flags that specify the contents of the DeviceNameOffset and NetProviderType fields. Values can be checked by performing a bitwise AND operation with the following constants:
.. c:member:: VALID_DEVICE
.. c:member:: VALID_NET_TYPE
*Example: lnk.common_network_relative_link.flags & lnk.VALID_DEVICE*
.. c:member:: net_name_offset
An unsigned integer that specifies the location of the NetName field.
.. c:member:: device_name_offset
An unsigned integer that specifies the location of the DeviceName field.
.. c:member:: network_provider_type
An unsigned integer that specifies the type of network provider. If present, it must be one of the following:
.. c:member:: WNNC_NET_AVID
.. c:member:: WNNC_NET_DOCUSPACE
.. c:member:: WNNC_NET_MANGOSOFT
.. c:member:: WNNC_NET_SERNET
.. c:member:: WNNC_NET_RIVERFRONT1
.. c:member:: WNNC_NET_RIVERFRONT2
.. c:member:: WNNC_NET_DECORB
.. c:member:: WNNC_NET_PROTSTOR
.. c:member:: WNNC_NET_FJ_REDIR
.. c:member:: WNNC_NET_DISTINCT
.. c:member:: WNNC_NET_TWINS
.. c:member:: WNNC_NET_RDR2SAMPLE
.. c:member:: WNNC_NET_CSC
.. c:member:: WNNC_NET_3IN1
.. c:member:: WNNC_NET_EXTENDNET
.. c:member:: WNNC_NET_STAC
.. c:member:: WNNC_NET_FOXBAT
.. c:member:: WNNC_NET_YAHOO
.. c:member:: WNNC_NET_EXIFS
.. c:member:: WNNC_NET_DAV
.. c:member:: WNNC_NET_KNOWARE
.. c:member:: WNNC_NET_OBJECT_DIRE
.. c:member:: WNNC_NET_MASFAX
.. c:member:: WNNC_NET_HOB_NFS
.. c:member:: WNNC_NET_SHIVA
.. c:member:: WNNC_NET_IBMAL
.. c:member:: WNNC_NET_LOCK
.. c:member:: WNNC_NET_TERMSRV
.. c:member:: WNNC_NET_SRT
.. c:member:: WNNC_NET_QUINCY
.. c:member:: WNNC_NET_OPENAFS
.. c:member:: WNNC_NET_AVID1
.. c:member:: WNNC_NET_DFS
.. c:member:: WNNC_NET_KWNP
.. c:member:: WNNC_NET_ZENWORKS
.. c:member:: WNNC_NET_DRIVEONWEB
.. c:member:: WNNC_NET_VMWARE
.. c:member:: WNNC_NET_RSFX
.. c:member:: WNNC_NET_MFILES
.. c:member:: WNNC_NET_MS_NFS
.. c:member:: WNNC_NET_GOOGLE
*Example: lnk.common_network_relative_link.network_provider_type == lnk.WNNC_NET_GOOGLE*
.. c:member:: net_name_offset_unicode
An unsigned integer that specifies the location of the NetNameUnicode field.
.. c:member:: device_name_offset_unicode
An unsigned integer that specifies the location of the DeviceNameUnicode field.
.. c:member:: net_name
A NULL–terminated string, as defined by the system default code page, which specifies a server share path.
*Example: lnk.link_info.common_network_relative_link.net_name == "\\\\server\\share"*
.. c:member:: device_name
A NULL–terminated string, as defined by the system default code page, which specifies a device.
*Example: lnk.link_info.common_network_relative_link.device_name == "Z:"*
.. c:member:: net_name_unicode
An optional, NULL–terminated, Unicode string that is the Unicode version of the NetName string.
.. c:member:: device_name_unicode
An optional, NULL–terminated, Unicode string that is the Unicode version of the DeviceName string.
.. c:member:: common_path_suffix
A NULL–terminated string, defined by the system default code page, which is used to construct the full path to the link item or link target by being appended to the string in the LocalBasePath field.
*Example: lnk.link_info.common_path_suffix == "\\x00"*
.. c:member:: local_base_path_unicode
An optional, NULL–terminated, Unicode string that is used to construct the full path to the link item or link target by appending the string in the CommonPathSuffixUnicode field.
.. c:member:: common_path_suffix_unicode
An optional, NULL–terminated, Unicode string that is used to construct the full path to the link item or link target by being appended to the string in the LocalBasePathUnicode field.
.. c:type:: name_string
An optional string that specifies a description of the shortcut that is displayed to end users to identify the purpose of the shell link.
*Example: lnk.name_string == "P\\x00e\\x00a\\x00Z\\x00i\\x00p\\x00 \\x00a\\x00r\\x00c\\x00h\\x00i\\x00v\\x00e\\x00r\\x00,\\x00 \\x00a\\x00d\\x00d\\x00 \\x00t\\x00o\\x00 \\x00e\\x00n\\x00c\\x00r\\x00y\\x00p\\x00t\\x00e\\x00d\\x00 \\x00.\\x00p\\x00e\\x00a\\x00 \\x00a\\x00r\\x00c\\x00h\\x00i\\x00v\\x00e\\x00"*
.. c:type:: relative_path
An optional string that specifies the location of the link target relative to the file that contains the shell link.
*Example: lnk.relative_path == ".\\x00\\\\\\x00a\\x00.\\x00t\\x00x\\x00t\\x00"*
.. c:type:: working_dir
An optional string that specifies the file system path of the working directory to be used when activating the link target.
*Example: lnk.working_dir == "C\\x00:\\x00\\\\\\x00t\\x00e\\x00s\\x00t\\x00"*
.. c:type:: command_line_arguments
An optional string that stores the command-line arguments that are specified when activating the link target
*Example: lnk.command_line_arguments == "-\\x00a\\x00d\\x00d\\x002\\x00c\\x00r\\x00y\\x00p\\x00t\\x00"*
.. c:type:: icon_location
An optional string that specifies the location of the icon to be used when displaying a shell link item in an icon view.
*Example: lnk.icon_location == "C\\x00:\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00 \\x00F\\x00i\\x00l\\x00e\\x00s\\x00\\\\x00P\\x00e\\x00a\\x00Z\\x00i\\x00p\\x00\\\\x00r\\x00e\\x00s\\x00\\\\x00i\\x00c\\x00o\\x00n\\x00s\\x00\\\\x00p\\x00e\\x00a\\x00z\\x00i\\x00p\\x00_\\x00n\\x00e\\x00w\\x00.\\x00i\\x00c\\x00l\\x00"*
.. c:type:: has_console_data
Boolean flag which is set if a ConsoleDataBlock structure is present.
*Example: lnk.has_console_data*
.. c:type:: console_data
The ConsoleDataBlock structure specifies the display settings to use when a link target specifies an application that is run in a console window.
.. c:member:: block_size
The block size of this structure, which will be equal to lnk.CONSOLE_DATA_BLOCK_SIZE.
.. c:member:: block_signature
The signature of the block, which will be equal to lnk.CONSOLE_DATA_BLOCK_SIGNATURE.
.. c:member:: fill_attributes
An unsigned integer that specifies the fill attributes that control the foreground and background text colors in the console window. The following bit definitions can be combined to specify 16 different values each for the foreground and background color:
.. c:member:: FOREGROUND_BLUE
.. c:member:: FOREGROUND_GREEN
.. c:member:: FOREGROUND_RED
.. c:member:: FOREGROUND_INTENSITY
.. c:member:: BACKGROUND_BLUE
.. c:member:: BACKGROUND_GREEN
.. c:member:: BACKGROUND_RED
.. c:member:: BACKGROUND_INTENSITY
*Example: lnk.console_data.fill_attributes & lnk.FOREGROUND_BLUE*
.. c:member:: popup_fill_attributes
An unsigned integer that specifies the fill attributes that control the foreground and background text color in the console window popup. The values are the same as for the FillAttributes field.
.. c:member:: screen_buffer_size_x
A signed integer that specifies the horizontal size (X axis), in characters, of the console window buffer.
*Example: lnk.console_data.screen_buffer_size_x == 120*
.. c:member:: screen_buffer_size_y
A signed integer that specifies the vertical size (Y axis), in characters, of the console window buffer.
*Example: lnk.console_data.screen_buffer_size_y == 3000*
.. c:member:: window_size_x
A signed integer that specifies the horizontal size (X axis), in characters, of the console window.
*Example: lnk.console_data.window_size_x == 120*
.. c:member:: window_size_y
A signed integer that specifies the vertical size (Y axis), in characters, of the console window.
*Example: lnk.console_data.window_size_y == 50*
.. c:member:: window_origin_x
A signed integer that specifies the horizontal coordinate (X axis), in pixels, of the console window origin.
*Example: lnk.console_data.window_origin_x == 0*
.. c:member:: window_origin_y
A signed integer that specifies the vertical coordinate (Y axis), in pixels, of the console window origin.
*Example: lnk.console_data.window_origin_y == 0*
.. c:member:: font_size
An unsigned integer that specifies the size, in pixels, of the font used in the console window. The two most significant bytes contain the font height and the two least significant bytes contain the font width. For vector fonts, the width is set to zero.
.. c:member:: font_family
An unsigned integer that specifies the family of the font used in the console window. This value must be comprised of a font family and a font pitch. The values for the font family are as follows:
.. c:member:: FF_DONTCARE
.. c:member:: FF_ROMAN
.. c:member:: FF_SWISS
.. c:member:: FF_MODERN
.. c:member:: FF_SCRIPT
.. c:member:: FF_DECORATIVE
A bitwise OR of one or more of the following font-pitch bits is added to the font family from the previous values:
.. c:member:: TMPF_NONE
.. c:member:: TMPF_FIXED_PITCH
.. c:member:: TMPF_VECTOR
.. c:member:: TMPF_TRUETYPE
.. c:member:: TMPF_DEVICE
.. c:member:: font_weight
An unsigned integer that specifies the stroke weight of the font used in the console window.
.. c:member:: face_name
A 32-character Unicode string that specifies the face name of the font used in the console window.
.. c:member:: cursor_size
An unsigned integer that specifies the size of the cursor, in pixels, used in the console window.
.. c:member:: full_screen
An unsigned integer that specifies whether to open the console window in full-screen mode.
.. c:member:: quick_edit
An unsigned integer that specifies whether to open the console window in QuickEdit mode.
.. c:member:: insert_mode
An unsigned integer that specifies insert mode in the console window.
.. c:member:: auto_position
An unsigned integer that specifies auto-position mode of the console window.
.. c:member:: history_buffer_size
An unsigned integer that specifies the size, in characters, of the buffer that is used to store a history of user input into the console window
.. c:member:: number_of_history_buffers
An unsigned integer that specifies the number of history buffers to use.
.. c:member:: history_no_dup
An unsigned integer that specifies whether to remove duplicates in the history buffer.
.. c:member:: color_table
A table of 16 32-bit, unsigned integers specifying the RGB colors that are used for text in the console window. The values of the fill attribute fields FillAttributes and PopupFillAttributes are used as indexes into this table to specify the final foreground and background color for a character.
.. c:type:: has_console_fe_data
Boolean flag which is set if a ConsoleFEDataBlock structure is present.
*Example: lnk.has_console_fe_data*
.. c:type:: console_fe_data
The ConsoleFEDataBlock structure specifies the code page to use for displaying text when a link target specifies an application that is run in a console window.
.. c:member:: block_size
The block size of this structure, which will be equal to lnk.CONSOLE_FE_DATA_BLOCK_SIZE.
.. c:member:: block_signature
The signature of the block, which will be equal to lnk.CONSOLE_FE_DATA_BLOCK_SIGNATURE.
.. c:member:: code_page
An unsigned integer that specifies a code page language code identifier.
.. c:type:: has_darwin_data
Boolean flag which is set if a DarwinDataBlock structure is present.
*Example: lnk.has_darwin_data*
.. c:type:: darwin_data
The DarwinDataBlock structure specifies an application identifier that can be used instead of a link target IDList to install an application when a shell link is activated.
.. c:member:: block_size
The block size of this structure, which will be equal to lnk.DARWIN_DATA_BLOCK_SIZE.
.. c:member:: block_signature
The signature of the block, which will be equal to lnk.DARWIN_DATA_BLOCK_SIGNATURE.
.. c:member:: darwin_data_ansi
A NULL–terminated string, defined by the system default code page, which specifies an application identifier.
.. c:member:: darwin_data_unicode
An optional, NULL–terminated, Unicode string that specifies an application identifier.
.. c:type:: has_environment_variable_data
Boolean flag which is set if a EnvironmentVariableDataBlock structure is present.
*Example: lnk.has_environment_variable_data*
.. c:type:: environment_variable_data
The EnvironmentVariableDataBlock structure specifies a path to environment variable information when the link target refers to a location that has a corresponding environment variable.
.. c:member:: block_size
The block size of this structure, which will be equal to lnk.ENVIRONMENT_VARIABLE_DATA_BLOCK_SIZE.
.. c:member:: block_signature
The signature of the block, which will be equal to lnk.ENVIRONMENT_VARIABLE_DATA_BLOCK_SIGNATURE.
.. c:member:: target_ansi
A NULL-terminated string, defined by the system default code page, which specifies a path to environment variable information
*Example: lnk.environment_variable_data.target_ansi == "%SystemRoot%\\sysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe"*
.. c:member:: target_unicode
An optional, NULL-terminated, Unicode string that specifies a path to environment variable information.
.. c:type:: has_icon_environment_data
Boolean flag which is set if a IconEnvironmentDataBlock structure is present.
*Example: lnk.has_icon_environment_data*
.. c:type:: icon_environment_data
The IconEnvironmentDataBlock structure specifies the path to an icon. The path is encoded using environment variables, which makes it possible to find the icon across machines where the locations vary but are expressed using environment variables.
.. c:member:: block_size
The block size of this structure, which will be equal to lnk.ICON_ENVIRONMENT_DATA_BLOCK_SIZE.
.. c:member:: block_signature
The signature of the block, which will be equal to lnk.ICON_ENVIRONMENT_DATA_BLOCK_SIGNATURE.
.. c:member:: target_ansi
A NULL-terminated string, defined by the system default code page, which specifies a path that is constructed with environment variables
*Example: lnk.icon_environment_data.target_ansi == "%ProgramFiles%\\PeaZip\\res\\icons\\peazip_new.icl"*
.. c:member:: target_unicode
An optional, NULL-terminated, Unicode string that specifies a path that is constructed with environment variables.
.. c:type:: has_known_folder_data
Boolean flag which is set if a KnownFolderDataBlock structure is present.
*Example: lnk.has_known_folder_data*
.. c:type:: known_folder_data
The KnownFolderDataBlock structure specifies the location of a known folder. This data can be used when a link target is a known folder to keep track of the folder so that the link target IDList can be translated when the link is loaded.
.. c:member:: block_size
The block size of this structure, which will be equal to lnk.KNOWN_FOLDER_DATA_BLOCK_SIZE.
.. c:member:: block_signature
The signature of the block, which will be equal to lnk.KNOWN_FOLDER_DATA_BLOCK_SIGNATURE.
.. c:member:: offset
An unsigned integer that specifies the location of the ItemID of the first child segment of the IDList specified by KnownFolderID. This value is the offset, in bytes, into the link target IDList.
*Example: lnk.known_folder_data.offset == 177*
.. c:member:: known_folder_id
A value in GUID packet representation that specifies the folder GUID ID.
*Example: lnk.known_folder_data.known_folder_id[15] == 142*
.. c:type:: has_property_store_data
Boolean flag which is set if a PropertyStoreDataBlock structure is present.
*Example: lnk.has_property_store_data*
.. c:type:: property_store_data
A PropertyStoreDataBlock structure specifies a set of properties that can be used by applications to store extra data in the shell link. (TODO: implement the rest of this structure)
.. c:member:: block_size
The block size of this structure, which will be greater than or equal to lnk.PROPERTY_STORE_DATA_BLOCK_MIN_SIZE.
.. c:member:: block_signature
The signature of the block, which will be equal to lnk.PROPERTY_STORE_DATA_BLOCK_SIGNATURE.
.. c:type:: has_shim_data
Boolean flag which is set if a ShimDataBlock structure is present.
*Example: lnk.has_shim_data*
.. c:type:: shim_data
The ShimDataBlock structure specifies the name of a shim that can be applied when activating a link target.
.. c:member:: block_size
The block size of this structure, which will be greater than or equal to lnk.SHIM_DATA_BLOCK_MIN_SIZE.
.. c:member:: block_signature
The signature of the block, which will be equal to lnk.SHIM_DATA_BLOCK_SIGNATURE.
.. c:member:: layer_name
A Unicode string that specifies the name of a shim layer to apply to a link target when it is being activated.
.. c:type:: has_special_folder_data
Boolean flag which is set if a SpecialFolderDataBlock structure is present.
*Example: lnk.has_special_folder_data*
.. c:type:: special_folder_data
The SpecialFolderDataBlock structure specifies the location of a special folder. This data can be used when a link target is a special folder to keep track of the folder, so that the link target IDList can be translated when the link is loaded.
.. c:member:: block_size
The block size of this structure, which will be equal to lnk.SPECIAL_FOLDER_DATA_BLOCK_SIZE.
.. c:member:: block_signature
The signature of the block, which will be equal to lnk.SPECIAL_FOLDER_DATA_BLOCK_SIGNATURE.
.. c:member:: offset
An unsigned integer that specifies the location of the ItemID of the first child segment of the IDList specified by SpecialFolderID. This value is the offset, in bytes, into the link target IDList.
.. c:member:: special_folder_id
An unsigned integer that specifies the folder integer ID.
.. c:type:: has_tracker_data
Boolean flag which is set if a TrackerDataBlock structure is present.
*Example: lnk.has_tracker_data*
.. c:type:: tracker_data
The TrackerDataBlock structure specifies data that can be used to resolve a link target if it is not found in its original location when the link is resolved. This data is passed to the Link Tracking service to find the link target.
.. c:member:: block_size
The block size of this structure, which will be equal to lnk.TRACKER_DATA_BLOCK_SIZE.
.. c:member:: block_signature
The signature of the block, which will be equal to lnk.TRACKER_DATA_BLOCK_SIGNATURE.
.. c:member:: machine_id
A NULL–terminated character string, as defined by the system default code page, which specifies the NetBIOS name of the machine where the link target was last known to reside.
*Example: lnk.tracker_data.machine_id == "chris-xps"*
.. c:member:: droid_volume_identifier
A parsed Droid volume identifier GUID.
*Example: lnk.tracker_data.droid_volume_identifier == "\\x40\\x78\\xC7\\x94\\x47\\xFA\\xC7\\x46\\xB3\\x56\\x5C\\x2D\\xC6\\xB6\\xD1\\x15"*
.. c:member:: droid_file_identifier
A parsed Droid file identifier GUID.
.. c:member:: droid_birth_volume_identifier
A parsed DroidBirth volume identifier GUID.
.. c:member:: droid_birth_file_identifier
A parsed DroidBirth file identifier GUID.
.. c:type:: has_vista_and_above_id_list_data
Boolean flag which is set if a VistaAndAboveIDListDataBlock structure is present.
*Example: lnk.has_vista_and_above_id_list_data*
.. c:type:: vista_and_above_id_list_data
The VistaAndAboveIDListDataBlock structure specifies an alternate IDList that can be used instead of the LinkTargetIDList structure on platforms that support it.
.. c:member:: block_size
The block size of this structure, which will be greater than or equal to lnk.VISTA_AND_ABOVE_ID_LIST_DATA_BLOCK_MIN_SIZE.
.. c:member:: block_signature
The signature of the block, which will be equal to lnk.VISTA_AND_ABOVE_ID_LIST_DATA_BLOCK_SIGNATURE.
.. c:member:: number_of_item_ids
The number of ItemID entries in the list.
.. c:type:: item_id_list
A zero-based array of ItemIDs structures. The data stored in a given ItemID is defined by the source that corresponds to the location in the target namespace of the preceding ItemIDs. This data uniquely identifies the items in that part of the namespace. Each ItemID has the following members:
.. c:member:: data
The shell data source-defined data that specifies an item.
.. c:member:: size
The size of the ItemID.
.. c:type:: has_overlay
A boolean value that is true if the LNK has extra data appended to it.
*Example: lnk.has_overlay*
.. c:type:: overlay_offset
An unsigned integer representing the offset into the LNK file of where the overlay starts (only set if the has_overlay flag is true).
*Example: lnk.overlay_offset == 0x1CB*
.. c:type:: is_malformed
A boolean value that is true if the LNK failed to be parsed due to it having malformed data.
*Example: lnk.is_malformed*
libyara/include/yara/lnk.h
-294
View File
@@ -1,294 +0,0 @@
#include <yara/integers.h>
#ifndef _LNK_H
#define _LNK_H
#define TICKS_PER_SECOND 10000000
#define EPOCH_DIFFERENCE 11644473600LL
#pragma pack(push)
#pragma pack(1)
typedef struct _shell_link_header_t
{
uint32_t header_size;
uint32_t clsid[4];
uint32_t link_flags;
uint32_t file_attributes_flags;
uint64_t creation_time;
uint64_t access_time;
uint64_t write_time;
uint32_t file_size;
uint32_t icon_index;
uint32_t show_command;
uint16_t hotkey_flags;
uint16_t reserved1;
uint32_t reserved2;
uint32_t reserved3;
} shell_link_header_t;
typedef struct _link_info_fixed_header_t
{
uint32_t link_info_size;
uint32_t link_info_header_size;
uint32_t link_info_flags;
uint32_t volume_id_offset;
uint32_t local_base_path_offset;
uint32_t common_network_relative_link_offset;
uint32_t common_path_suffix_offset;
} link_info_fixed_header_t;
typedef struct _volume_id_t
{
uint32_t volume_id_size;
uint32_t drive_type;
uint32_t drive_serial_number;
uint32_t volume_label_offset;
} volume_id_t;
typedef struct _common_network_relative_link_t
{
uint32_t common_network_relative_link_size;
uint32_t common_network_relative_link_flags;
uint32_t net_name_offset;
uint32_t device_name_offset;
uint32_t network_provider_type;
} common_network_relative_link_t;
typedef struct _console_data_block_t
{
uint16_t fill_attributes;
uint16_t popup_fill_attributes;
int16_t screen_buffer_size_x;
int16_t screen_buffer_size_y;
int16_t window_size_x;
int16_t window_size_y;
int16_t window_origin_x;
int16_t window_origin_y;
uint32_t unused_1;
uint32_t unused_2;
uint32_t font_size;
uint32_t font_family;
uint32_t font_weight;
uint16_t face_name[32];
uint32_t cursor_size;
uint32_t full_screen;
uint32_t quick_edit;
uint32_t insert_mode;
uint32_t auto_position;
uint32_t history_buffer_size;
uint32_t number_of_history_buffers;
uint32_t history_no_dup;
uint32_t color_table[16];
} console_data_block_t;
typedef struct _console_fe_data_block_t
{
uint32_t code_page;
} console_fe_data_block_t;
typedef struct _darwin_data_block_t
{
char darwin_data_ansi[260];
uint16_t darwin_data_unicode[260];
} darwin_data_block_t;
typedef struct _environment_variable_data_block_t
{
char target_ansi[260];
uint16_t target_unicode[260];
} environment_variable_data_block_t;
typedef struct _icon_environment_data_block_t
{
char target_ansi[260];
uint16_t target_unicode[260];
} icon_environment_data_block_t;
typedef struct _known_folder_data_block_t
{
uint8_t known_folder_id[16];
uint32_t offset;
} known_folder_data_block_t;
typedef struct _special_folder_data_block_t
{
uint32_t special_folder_id;
uint32_t offset;
} special_folder_data_block_t;
typedef struct _tracker_data_block_t
{
uint32_t length;
uint32_t version;
char machine_id[16];
uint8_t droid_volume_identifier[16];
uint8_t droid_file_identifier[16];
uint8_t droid_birth_volume_identifier[16];
uint8_t droid_birth_file_identifier[16];
} tracker_data_block_t;
#pragma pack(pop)
#define HEADER_SIZE 0x0000004C
#define LINK_CLSID_0 0x00021401
#define LINK_CLSID_1 0x00000000
#define LINK_CLSID_2 0x000000C0
#define LINK_CLSID_3 0x46000000
#define HAS_LINK_TARGET_ID_LIST 0x00000001
#define HAS_LINK_INFO 0x00000002
#define HAS_NAME 0x00000004
#define HAS_RELATIVE_PATH 0x00000008
#define HAS_WORKING_DIR 0x00000010
#define HAS_ARGUMENTS 0x00000020
#define HAS_ICON_LOCATION 0x00000040
#define IS_UNICODE 0x00000080
#define FORCE_NO_LINK_INFO 0x00000100
#define HAS_EXP_STRING 0x00000200
#define RUN_IN_SEPARATE_PROCESS 0x00000400
#define UNUSED_1 0x00000800
#define HAS_DARWIN_ID 0x00001000
#define RUN_AS_USER 0x00002000
#define HAS_EXP_ICON 0x00004000
#define NO_PIDL_ALIAS 0x00008000
#define UNUSED_2 0x00010000
#define RUN_WITH_SHIM_LAYER 0x00020000
#define FORCE_NO_LINK_TRACK 0x00040000
#define ENABLE_TARGET_METADATA 0x00080000
#define DISABLE_LINK_PATH_TRACKING 0x00100000
#define DISABLE_KNOWN_FOLDER_TRACKING 0x00200000
#define DISABLE_KNOWN_FOLDER_ALIAS 0x00400000
#define ALLOW_LINK_TO_LINK 0x00800000
#define UNALIAS_ON_SAVE 0x01000000
#define PREFER_ENVIRONMENT_PATH 0x02000000
#define KEEP_LOCAL_ID_LIST_FOR_UNC_TARGET 0x04000000
#define FILE_ATTRIBUTE_READONLY 0x00000001
#define FILE_ATTRIBUTE_HIDDEN 0x00000002
#define FILE_ATTRIBUTE_SYSTEM 0x00000004
#define RESERVED_1 0x00000008
#define FILE_ATTRIBUTE_DIRECTORY 0x00000010
#define FILE_ATTRIBUTE_ARCHIVE 0x00000020
#define RESERVED_2 0x00000040
#define FILE_ATTRIBUTE_NORMAL 0x00000080
#define FILE_ATTRIBUTE_TEMPORARY 0x00000100
#define FILE_ATTRIBUTE_SPARSE_FILE 0x00000200
#define FILE_ATTRIBUTE_REPARSE_POINT 0x00000400
#define FILE_ATTRIBUTE_COMPRESSED 0x00000800
#define FILE_ATTRIBUTE_OFFLINE 0x00001000
#define FILE_ATTRIBUTE_NOT_CONTENT_INDEXED 0x00002000
#define FILE_ATTRIBUTE_ENCRYPTED 0x00004000
#define SW_SHOWNORMAL 0x00000001
#define SW_SHOWMAXIMIZED 0x00000003
#define SW_SHOWMINNOACTIVE 0x00000007
#define HOTKEYF_SHIFT 0x01
#define HOTKEYF_CONTROL 0x02
#define HOTKEYF_ALT 0x04
#define VOLUME_ID_AND_LOCAL_BASE_PATH 0x01
#define COMMON_NETWORK_RELATIVE_LINK_AND_PATH_SUFFIX 0x02
#define DRIVE_UNKNOWN 0x00
#define DRIVE_NO_ROOT_DIR 0x01
#define DRIVE_REMOVABLE 0x02
#define DRIVE_FIXED 0x03
#define DRIVE_REMOTE 0x04
#define DRIVE_CDROM 0x05
#define DRIVE_RAMDISK 0x06
#define VALID_DEVICE 0x01
#define VALID_NET_TYPE 0x02
#define WNNC_NET_AVID 0x001A0000
#define WNNC_NET_DOCUSPACE 0x001B0000
#define WNNC_NET_MANGOSOFT 0x001C0000
#define WNNC_NET_SERNET 0x001D0000
#define WNNC_NET_RIVERFRONT1 0X001E0000
#define WNNC_NET_RIVERFRONT2 0x001F0000
#define WNNC_NET_DECORB 0x00200000
#define WNNC_NET_PROTSTOR 0x00210000
#define WNNC_NET_FJ_REDIR 0x00220000
#define WNNC_NET_DISTINCT 0x00230000
#define WNNC_NET_TWINS 0x00240000
#define WNNC_NET_RDR2SAMPLE 0x00250000
#define WNNC_NET_CSC 0x00260000
#define WNNC_NET_3IN1 0x00270000
#define WNNC_NET_EXTENDNET 0x00290000
#define WNNC_NET_STAC 0x002A0000
#define WNNC_NET_FOXBAT 0x002B0000
#define WNNC_NET_YAHOO 0x002C0000
#define WNNC_NET_EXIFS 0x002D0000
#define WNNC_NET_DAV 0x002E0000
#define WNNC_NET_KNOWARE 0x002F0000
#define WNNC_NET_OBJECT_DIRE 0x00300000
#define WNNC_NET_MASFAX 0x00310000
#define WNNC_NET_HOB_NFS 0x00320000
#define WNNC_NET_SHIVA 0x00330000
#define WNNC_NET_IBMAL 0x00340000
#define WNNC_NET_LOCK 0x00350000
#define WNNC_NET_TERMSRV 0x00360000
#define WNNC_NET_SRT 0x00370000
#define WNNC_NET_QUINCY 0x00380000
#define WNNC_NET_OPENAFS 0x00390000
#define WNNC_NET_AVID1 0X003A0000
#define WNNC_NET_DFS 0x003B0000
#define WNNC_NET_KWNP 0x003C0000
#define WNNC_NET_ZENWORKS 0x003D0000
#define WNNC_NET_DRIVEONWEB 0x003E0000
#define WNNC_NET_VMWARE 0x003F0000
#define WNNC_NET_RSFX 0x00400000
#define WNNC_NET_MFILES 0x00410000
#define WNNC_NET_MS_NFS 0x00420000
#define WNNC_NET_GOOGLE 0x00430000
#define FOREGROUND_BLUE 0x0001
#define FOREGROUND_GREEN 0x0002
#define FOREGROUND_RED 0x0004
#define FOREGROUND_INTENSITY 0x0008
#define BACKGROUND_BLUE 0x0010
#define BACKGROUND_GREEN 0x0020
#define BACKGROUND_RED 0x0040
#define BACKGROUND_INTENSITY 0x0080
#define FF_DONTCARE 0x0000
#define FF_ROMAN 0x0010
#define FF_SWISS 0x0020
#define FF_MODERN 0x0030
#define FF_SCRIPT 0x0040
#define FF_DECORATIVE 0x0050
#define TMPF_NONE 0x0000
#define TMPF_FIXED_PITCH 0x0001
#define TMPF_VECTOR 0x0002
#define TMPF_TRUETYPE 0x0004
#define TMPF_DEVICE 0x0008
#define CONSOLE_DATA_BLOCK_SIZE 0x000000CC
#define CONSOLE_FE_DATA_BLOCK_SIZE 0x0000000C
#define DARWIN_DATA_BLOCK_SIZE 0x00000314
#define ENVIRONMENT_VARIABLE_DATA_BLOCK_SIZE 0x00000314
#define ICON_ENVIRONMENT_DATA_BLOCK_SIZE 0x00000314
#define KNOWN_FOLDER_DATA_BLOCK_SIZE 0x0000001C
#define PROPERTY_STORE_DATA_BLOCK_MIN_SIZE 0x0000000C
#define SHIM_DATA_BLOCK_MIN_SIZE 0x00000088
#define SPECIAL_FOLDER_DATA_BLOCK_SIZE 0x00000010
#define TRACKER_DATA_BLOCK_SIZE 0x00000060
#define VISTA_AND_ABOVE_ID_LIST_DATA_BLOCK_MIN_SIZE 0x0000000A
#define CONSOLE_DATA_BLOCK_SIGNATURE 0xA0000002
#define CONSOLE_FE_DATA_BLOCK_SIGNATURE 0xA0000004
#define DARWIN_DATA_BLOCK_SIGNATURE 0xA0000006
#define ENVIRONMENT_VARIABLE_DATA_BLOCK_SIGNATURE 0xA0000001
#define ICON_ENVIRONMENT_DATA_BLOCK_SIGNATURE 0xA0000007
#define KNOWN_FOLDER_DATA_BLOCK_SIGNATURE 0xA000000B
#define PROPERTY_STORE_DATA_BLOCK_SIGNATURE 0xA0000009
#define SHIM_DATA_BLOCK_SIGNATURE 0xA0000008
#define SPECIAL_FOLDER_DATA_BLOCK_SIGNATURE 0xA0000005
#define TRACKER_DATA_BLOCK_SIGNATURE 0xA0000003
#define VISTA_AND_ABOVE_ID_LIST_DATA_BLOCK_SIGNATURE 0xA000000C
#endif
libyara/include/yara/lnk_utils.h
-9
View File
@@ -1,9 +0,0 @@
#ifndef YR_LNK_UTILS_H
#define YR_LNK_UTILS_H
#include <yara/lnk.h>
uint64_t convertWindowsTimeToUnixTime(uint64_t input);
char* get_hotkey_char(uint8_t key);
#endif
libyara/modules/lnk/lnk.c
-2391
View File
File diff suppressed because it is too large Load Diff
libyara/modules/lnk/lnk_utils.c
-277
View File
@@ -1,277 +0,0 @@
#include <stdio.h>
#include <string.h>
#include <yara/endian.h>
#include <yara/integers.h>
#include <yara/lnk.h>
#include <yara/lnk_utils.h>
#include <yara/mem.h>
#include <yara/strutils.h>
#include <yara/utils.h>
uint64_t convertWindowsTimeToUnixTime(uint64_t input)
{
// https://stackoverflow.com/questions/6161776/convert-windows-filetime-to-second-in-unix-linux
long long int temp;
temp = input / TICKS_PER_SECOND; // convert from 100ns intervals to seconds;
temp = temp - EPOCH_DIFFERENCE; // subtract number of seconds between epochs
return temp;
}
char* get_hotkey_char(uint8_t key)
{
char key_str[64];
key_str[0] = '\0';
switch (key)
{
case 0x30:
sprintf(key_str, "0");
break;
case 0x31:
sprintf(key_str, "1");
break;
case 0x32:
sprintf(key_str, "2");
break;
case 0x33:
sprintf(key_str, "3");
break;
case 0x34:
sprintf(key_str, "4");
break;
case 0x35:
sprintf(key_str, "5");
break;
case 0x36:
sprintf(key_str, "6");
break;
case 0x37:
sprintf(key_str, "7");
break;
case 0x38:
sprintf(key_str, "8");
break;
case 0x39:
sprintf(key_str, "9");
break;
case 0x41:
sprintf(key_str, "A");
break;
case 0x42:
sprintf(key_str, "B");
break;
case 0x43:
sprintf(key_str, "C");
break;
case 0x44:
sprintf(key_str, "D");
break;
case 0x45:
sprintf(key_str, "E");
break;
case 0x46:
sprintf(key_str, "F");
break;
case 0x47:
sprintf(key_str, "G");
break;
case 0x48:
sprintf(key_str, "H");
break;
case 0x49:
sprintf(key_str, "I");
break;
case 0x4A:
sprintf(key_str, "J");
break;
case 0x4B:
sprintf(key_str, "K");
break;
case 0x4C:
sprintf(key_str, "L");
break;
case 0x4D:
sprintf(key_str, "M");
break;
case 0x4E:
sprintf(key_str, "N");
break;
case 0x4F:
sprintf(key_str, "O");
break;
case 0x50:
sprintf(key_str, "P");
break;
case 0x51:
sprintf(key_str, "Q");
break;
case 0x52:
sprintf(key_str, "R");
break;
case 0x53:
sprintf(key_str, "S");
break;
case 0x54:
sprintf(key_str, "T");
break;
case 0x55:
sprintf(key_str, "U");
break;
case 0x56:
sprintf(key_str, "V");
break;
case 0x57:
sprintf(key_str, "W");
break;
case 0x58:
sprintf(key_str, "X");
break;
case 0x59:
sprintf(key_str, "Y");
break;
case 0x5A:
sprintf(key_str, "Z");
break;
case 0x70:
sprintf(key_str, "F1");
break;
case 0x71:
sprintf(key_str, "F2");
break;
case 0x72:
sprintf(key_str, "F3");
break;
case 0x73:
sprintf(key_str, "F4");
break;
case 0x74:
sprintf(key_str, "F5");
break;
case 0x75:
sprintf(key_str, "F6");
break;
case 0x76:
sprintf(key_str, "F7");
break;
case 0x77:
sprintf(key_str, "F8");
break;
case 0x78:
sprintf(key_str, "F9");
break;
case 0x79:
sprintf(key_str, "F10");
break;
case 0x7A:
sprintf(key_str, "F11");
break;
case 0x7B:
sprintf(key_str, "F12");
break;
case 0x7C:
sprintf(key_str, "F13");
break;
case 0x7D:
sprintf(key_str, "F14");
break;
case 0x7E:
sprintf(key_str, "F15");
break;
case 0x7F:
sprintf(key_str, "F16");
break;
case 0x80:
sprintf(key_str, "F17");
break;
case 0x81:
sprintf(key_str, "F18");
break;
case 0x82:
sprintf(key_str, "F19");
break;
case 0x83:
sprintf(key_str, "F20");
break;
case 0x84:
sprintf(key_str, "F21");
break;
case 0x85:
sprintf(key_str, "F22");
break;
case 0x86:
sprintf(key_str, "F23");
break;
case 0x87:
sprintf(key_str, "F24");
break;
case 0x90:
sprintf(key_str, "NUM LOCK");
break;
case 0x91:
sprintf(key_str, "SCROLL LOCK");
break;
}
return yr_strdup(key_str);
}
libyara/modules/module_list
+1 -2
View File
@@ -5,7 +5,6 @@ MODULE(math)
MODULE(time)
MODULE(console)
MODULE(string)
MODULE(lnk)
#ifdef DOTNET_MODULE
MODULE(dotnet)
@@ -33,4 +32,4 @@ MODULE(dex)
#ifdef PB_TESTS_MODULE
MODULE(pb_tests)
#endif
#endif
tests/BUILD.bazel
-19
View File
@@ -278,22 +278,3 @@ cc_test(
"@//:libyara",
],
)
cc_test(
name = "test_lnk",
srcs = ["test-lnk.c"],
copts = COPTS,
data = [
"data/lnk-standard",
"data/lnk-extradata-1",
"data/lnk-extradata-2",
"data/lnk-malformed",
"data/lnk-network",
"data/lnk-overlay",
],
linkstatic = True,
deps = [
":util",
"@//:libyara",
],
)
tests/data/lnk-extradata-1
BIN
View File
Binary file not shown.
tests/data/lnk-extradata-2
BIN
View File
Binary file not shown.
tests/data/lnk-malformed
BIN
View File
Binary file not shown.
tests/data/lnk-network
BIN
View File
Binary file not shown.
tests/data/lnk-overlay
BIN
View File
Binary file not shown.
tests/data/lnk-standard
BIN
View File
Binary file not shown.
tests/test-lnk.c
-505
View File
@@ -1,505 +0,0 @@
#include <stdio.h>
#include <stdlib.h>
#include <yara.h>
#include "util.h"
int main(int argc, char** argv)
{
int result = 0;
YR_DEBUG_INITIALIZE();
YR_DEBUG_FPRINTF(1, stderr, "+ %s() { // in %s\n", __FUNCTION__, argv[0]);
init_top_srcdir();
yr_initialize();
assert_true_rule_file(
"import \"lnk\" \
rule is_lnk { \
condition: \
lnk.is_lnk \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule creation_time { \
condition: \
lnk.creation_time == 1221251237 \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule access_time { \
condition: \
lnk.access_time == 1221251237 \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule write_time { \
condition: \
lnk.write_time == 1221251237 \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule has_link_target_id_list { \
condition: \
lnk.link_flags & lnk.HAS_LINK_TARGET_ID_LIST \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule has_link_info { \
condition: \
lnk.link_flags & lnk.HAS_LINK_INFO \
}",
"tests/data/lnk-standard");
assert_false_rule_file(
"import \"lnk\" \
rule has_name { \
condition: \
lnk.link_flags & lnk.HAS_NAME \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule file_attribute_archive { \
condition: \
lnk.file_attributes_flags & lnk.FILE_ATTRIBUTE_ARCHIVE \
}",
"tests/data/lnk-standard");
assert_false_rule_file(
"import \"lnk\" \
rule file_attribute_readonly { \
condition: \
lnk.file_attributes_flags & lnk.FILE_ATTRIBUTE_READONLY \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule show_command { \
condition: \
lnk.show_command == lnk.SW_SHOWNORMAL \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule no_hotkey { \
condition: \
not lnk.has_hotkey and not defined lnk.hotkey \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule item_id_list_size { \
condition: \
lnk.link_target_id_list.item_id_list_size == 0xBD \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule number_of_item_ids { \
condition: \
lnk.link_target_id_list.number_of_item_ids == 4 \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule item_id_first_element { \
condition: \
lnk.link_target_id_list.item_id_list[0].size == 0x12 and lnk.link_target_id_list.item_id_list[0].data == \"\\x1fP\\xe0O\\xd0 \\xea:i\\x10\\xa2\\xd8\\x08\\x00+00\\x9d\" \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule item_id_first_element { \
condition: \
lnk.link_target_id_list.item_id_list[3].size == 0x46 and lnk.link_target_id_list.item_id_list[3].data == \"2\\x00\\x00\\x00\\x00\\x00,9i\\xa3 \\x00a.txt\\x004\\x00\\x07\\x00\\x04\\x00\\xef\\xbe,9i\\xa3,9i\\xa3&\\x00\\x00\\x00-n\\x00\\x00\\x00\\x00\\x96\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00a\\x00.\\x00t\\x00x\\x00t\\x00\\x00\\x00\\x14\\x00\" \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule link_info_size { \
condition: \
lnk.link_info.size == 0x3C \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule link_info_header_size { \
condition: \
lnk.link_info.header_size == 0x1C \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule link_info_flags { \
condition: \
lnk.link_info.flags & lnk.VOLUME_ID_AND_LOCAL_BASE_PATH \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule volume_id_offset { \
condition: \
lnk.link_info.volume_id_offset == 0x1C \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule has_volume_id { \
condition: \
lnk.link_info.has_volume_id \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule local_base_path_offset { \
condition: \
lnk.link_info.local_base_path_offset == 0x2D \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule common_network_relative_link_offset { \
condition: \
lnk.link_info.common_network_relative_link_offset == 0 \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule common_path_suffix_offset { \
condition: \
lnk.link_info.common_path_suffix_offset == 0x3B \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule volume_id_size { \
condition: \
lnk.link_info.volume_id.size == 17 \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule drive_type { \
condition: \
lnk.link_info.volume_id.drive_type & lnk.DRIVE_FIXED \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule drive_serial_number { \
condition: \
lnk.link_info.volume_id.drive_serial_number == 0x307A8A81 \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule volume_label_offset { \
condition: \
lnk.link_info.volume_id.volume_label_offset == 0x10 \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule volume_id_data { \
condition: \
lnk.link_info.volume_id.data == \"\\x00\" \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule local_base_path { \
condition: \
lnk.link_info.local_base_path == \"C:\\\\test\\\\a.txt\" \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule common_path_suffix { \
condition: \
lnk.link_info.common_path_suffix == \"\\x00\" \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule relative_path { \
condition: \
lnk.relative_path == \".\\x00\\\\\\x00a\\x00.\\x00t\\x00x\\x00t\\x00\" \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule working_dir { \
condition: \
lnk.working_dir == \"C\\x00:\\x00\\\\\\x00t\\x00e\\x00s\\x00t\\x00\" \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule has_tracker_data { \
condition: \
lnk.has_tracker_data \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule tracker_data_block_size { \
condition: \
lnk.tracker_data.block_size == 0x60 \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule tracker_data_block_signature { \
condition: \
lnk.tracker_data.block_signature == 0xA0000003 \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule machine_id { \
condition: \
lnk.tracker_data.machine_id == \"chris-xps\" \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule droid_volume_identifier { \
condition: \
lnk.tracker_data.droid_volume_identifier == \"\\x40\\x78\\xC7\\x94\\x47\\xFA\\xC7\\x46\\xB3\\x56\\x5C\\x2D\\xC6\\xB6\\xD1\\x15\" \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule droid_file_identifier { \
condition: \
lnk.tracker_data.droid_file_identifier == \"\\xEC\\x46\\xCD\\x7B\\x22\\x7F\\xDD\\x11\\x94\\x99\\x00\\x13\\x72\\x16\\x87\\x4A\" \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule droid_birth_volume_identifier { \
condition: \
lnk.tracker_data.droid_birth_volume_identifier == \"\\x40\\x78\\xC7\\x94\\x47\\xFA\\xC7\\x46\\xB3\\x56\\x5C\\x2D\\xC6\\xB6\\xD1\\x15\" \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule droid_birth_file_identifier { \
condition: \
lnk.tracker_data.droid_birth_file_identifier == \"\\xEC\\x46\\xCD\\x7B\\x22\\x7F\\xDD\\x11\\x94\\x99\\x00\\x13\\x72\\x16\\x87\\x4A\" \
}",
"tests/data/lnk-standard");
assert_true_rule_file(
"import \"lnk\" \
rule common_network_relative_link_flags { \
condition: \
lnk.link_info.common_network_relative_link.flags & lnk.VALID_NET_TYPE \
}",
"tests/data/lnk-network");
assert_true_rule_file(
"import \"lnk\" \
rule net_name { \
condition: \
lnk.link_info.common_network_relative_link.net_name == \"\\\\\\\\localhost\\\\c$\\\\Users\\\\yarac\\\\Documents\\\\testing\" \
}",
"tests/data/lnk-network");
assert_true_rule_file(
"import \"lnk\" \
rule device_name { \
condition: \
lnk.link_info.common_network_relative_link.device_name == \"Z:\" \
}",
"tests/data/lnk-network");
// VolumeID has been set from 0x11 to an impossibly large value 0xFFFFFFFF
assert_true_rule_file(
"import \"lnk\" \
rule malformed_lnk { \
condition: \
lnk.is_malformed \
}",
"tests/data/lnk-malformed");
assert_true_rule_file(
"import \"lnk\" \
rule overlay_lnk { \
condition: \
lnk.has_overlay and lnk.overlay_offset == 0x1CB \
}",
"tests/data/lnk-overlay");
assert_true_rule_file(
"import \"lnk\" \
rule has_console_data { \
condition: \
lnk.has_console_data \
}",
"tests/data/lnk-extradata-1");
assert_true_rule_file(
"import \"lnk\" \
rule number_of_history_buffers { \
condition: \
lnk.console_data.number_of_history_buffers == 4 \
}",
"tests/data/lnk-extradata-1");
assert_true_rule_file(
"import \"lnk\" \
rule color_table { \
condition: \
lnk.console_data.color_table[15] == 0x00ffffff \
}",
"tests/data/lnk-extradata-1");
assert_true_rule_file(
"import \"lnk\" \
rule screen_buffer_size { \
condition: \
lnk.console_data.screen_buffer_size_x == 120 and lnk.console_data.screen_buffer_size_y == 3000 \
}",
"tests/data/lnk-extradata-1");
assert_true_rule_file(
"import \"lnk\" \
rule window_size { \
condition: \
lnk.console_data.window_size_x == 120 and lnk.console_data.window_size_y == 50 \
}",
"tests/data/lnk-extradata-1");
assert_true_rule_file(
"import \"lnk\" \
rule window_origin { \
condition: \
lnk.console_data.window_origin_x == 0 and lnk.console_data.window_origin_y == 0 \
}",
"tests/data/lnk-extradata-1");
assert_true_rule_file(
"import \"lnk\" \
rule has_environment_variable_data { \
condition: \
lnk.has_environment_variable_data \
}",
"tests/data/lnk-extradata-1");
assert_true_rule_file(
"import \"lnk\" \
rule environment_variable_data_ansi { \
condition: \
lnk.environment_variable_data.target_ansi == \"%SystemRoot%\\\\sysWOW64\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\" \
}",
"tests/data/lnk-extradata-1");
assert_true_rule_file(
"import \"lnk\" \
rule has_special_folder_data { \
condition: \
lnk.has_special_folder_data \
}",
"tests/data/lnk-extradata-1");
assert_true_rule_file(
"import \"lnk\" \
rule special_folder_data { \
condition: \
lnk.special_folder_data.special_folder_id == 36 and lnk.special_folder_data.offset == 105 \
}",
"tests/data/lnk-extradata-1");
assert_true_rule_file(
"import \"lnk\" \
rule icon_environment_data_target_ansi { \
condition: \
lnk.icon_environment_data.target_ansi == \"%ProgramFiles%\\\\PeaZip\\\\res\\\\icons\\\\peazip_new.icl\" \
}",
"tests/data/lnk-extradata-2");
assert_true_rule_file(
"import \"lnk\" \
rule has_icon_environment_data { \
condition: \
lnk.has_icon_environment_data \
}",
"tests/data/lnk-extradata-2");
assert_true_rule_file(
"import \"lnk\" \
rule has_known_folder_data { \
condition: \
lnk.has_known_folder_data \
}",
"tests/data/lnk-extradata-2");
assert_true_rule_file(
"import \"lnk\" \
rule known_folder_offset { \
condition: \
lnk.known_folder_data.offset == 177 \
}",
"tests/data/lnk-extradata-2");
assert_true_rule_file(
"import \"lnk\" \
rule known_folder_id { \
condition: \
lnk.known_folder_data.known_folder_id[15] == 142 \
}",
"tests/data/lnk-extradata-2");
yr_finalize();
YR_DEBUG_FPRINTF(
1, stderr, "} = %d // %s() in %s\n", result, __FUNCTION__, argv[0]);
return result;
}
windows/vs2015/libyara/libyara.vcxproj
-2
View File
@@ -244,8 +244,6 @@
<ClCompile Include="..\..\..\libyara\modules\dotnet\dotnet.c" />
<ClCompile Include="..\..\..\libyara\modules\elf\elf.c" />
<ClCompile Include="..\..\..\libyara\modules\hash\hash.c" />
<ClCompile Include="..\..\..\libyara\modules\lnk\lnk.c" />
<ClCompile Include="..\..\..\libyara\modules\lnk\lnk_utils.c" />
<ClCompile Include="..\..\..\libyara\modules\math\math.c" />
<ClCompile Include="..\..\..\libyara\modules\macho\macho.c" />
<ClCompile Include="..\..\..\libyara\modules\pe\pe.c" />
windows/vs2017/libyara/libyara.vcxproj
-2
View File
@@ -243,8 +243,6 @@
<ClCompile Include="..\..\..\libyara\modules\dotnet\dotnet.c" />
<ClCompile Include="..\..\..\libyara\modules\elf\elf.c" />
<ClCompile Include="..\..\..\libyara\modules\hash\hash.c" />
<ClCompile Include="..\..\..\libyara\modules\lnk\lnk.c" />
<ClCompile Include="..\..\..\libyara\modules\lnk\lnk_utils.c" />
<ClCompile Include="..\..\..\libyara\modules\math\math.c" />
<ClCompile Include="..\..\..\libyara\modules\macho\macho.c" />
<ClCompile Include="..\..\..\libyara\modules\pe\pe.c" />