mirror of
https://github.com/VirusTotal/yara.git
synced 2026-10-11 22:49:58 +00:00
HoundTheandVictor M. Alvarez
b9cd46df15
* Import authenticode-parser into Yara. Rewrite PE signature processing using the authenticode-parser. Update bazel OpenSSL dependency to 1.1.1 from 1.1.0 * Forgot to include structs.c * Add Avast to authors and myself to contributors * Set forgotten algorithm_oid * Fix incorrect indentation * Fix race condition when initializing openssl objects * Don't malloc ByteArray with length 0 * Auth. parser update - bug fixes, openssl3.0 support * Update authenticode parser Co-authored-by: Victor M. Alvarez <[email protected]>
79 lines
3.2 KiB
C
79 lines
3.2 KiB
C
/* Copyright (c) 2021 Avast Software
|
|
|
|
Permission is hereby granted, free of charge, to any person obtaining a copy of
|
|
this software and associated documentation files (the "Software"), to deal
|
|
in the Software without restriction, including without limitation the rights to
|
|
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
|
|
of the Software, and to permit persons to whom the Software is furnished to do
|
|
so, subject to the following conditions:
|
|
|
|
The above copyright notice and this permission notice shall be included in all
|
|
copies or substantial portions of the Software.
|
|
|
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
SOFTWARE.
|
|
*/
|
|
|
|
#include "structs.h"
|
|
|
|
ASN1_CHOICE(SpcString) = {
|
|
ASN1_IMP_OPT(SpcString, value.unicode, ASN1_BMPSTRING, 0),
|
|
ASN1_IMP_OPT(SpcString, value.ascii, ASN1_IA5STRING, 1)
|
|
} ASN1_CHOICE_END(SpcString)
|
|
|
|
ASN1_SEQUENCE(SpcSerializedObject) = {
|
|
ASN1_SIMPLE(SpcSerializedObject, classId, ASN1_OCTET_STRING),
|
|
ASN1_SIMPLE(SpcSerializedObject, serializedData, ASN1_OCTET_STRING)
|
|
} ASN1_SEQUENCE_END(SpcSerializedObject)
|
|
|
|
ASN1_CHOICE(SpcLink) = {
|
|
ASN1_IMP_OPT(SpcLink, value.url, ASN1_IA5STRING, 0),
|
|
ASN1_IMP_OPT(SpcLink, value.moniker, SpcSerializedObject, 1),
|
|
ASN1_EXP_OPT(SpcLink, value.file, SpcString, 2)
|
|
} ASN1_CHOICE_END(SpcLink)
|
|
|
|
ASN1_SEQUENCE(SpcAttributeTypeAndOptionalValue) = {
|
|
ASN1_SIMPLE(SpcAttributeTypeAndOptionalValue, type, ASN1_OBJECT),
|
|
ASN1_OPT(SpcAttributeTypeAndOptionalValue, value, ASN1_ANY)
|
|
} ASN1_SEQUENCE_END(SpcAttributeTypeAndOptionalValue)
|
|
|
|
ASN1_SEQUENCE(SpcPeImageData) = {
|
|
ASN1_SIMPLE(SpcPeImageData, flags, ASN1_BIT_STRING),
|
|
ASN1_EXP_OPT(SpcPeImageData, file, SpcLink, 0)
|
|
} ASN1_SEQUENCE_END(SpcPeImageData)
|
|
|
|
ASN1_SEQUENCE(AlgorithmIdentifier) = {
|
|
ASN1_SIMPLE(AlgorithmIdentifier, algorithm, ASN1_OBJECT),
|
|
ASN1_OPT(AlgorithmIdentifier, parameters, ASN1_ANY)
|
|
} ASN1_SEQUENCE_END(AlgorithmIdentifier)
|
|
|
|
ASN1_SEQUENCE(DigestInfo) = {
|
|
ASN1_SIMPLE(DigestInfo, digestAlgorithm, AlgorithmIdentifier),
|
|
ASN1_SIMPLE(DigestInfo, digest, ASN1_OCTET_STRING)
|
|
} ASN1_SEQUENCE_END(DigestInfo)
|
|
|
|
ASN1_SEQUENCE(SpcIndirectDataContent) = {
|
|
ASN1_SIMPLE(SpcIndirectDataContent, data, SpcAttributeTypeAndOptionalValue),
|
|
ASN1_SIMPLE(SpcIndirectDataContent, messageDigest, DigestInfo)
|
|
} ASN1_SEQUENCE_END(SpcIndirectDataContent)
|
|
|
|
ASN1_SEQUENCE(SpcSpOpusInfo) = {
|
|
ASN1_EXP_OPT(SpcSpOpusInfo, programName, SpcString, 0),
|
|
ASN1_EXP_OPT(SpcSpOpusInfo, moreInfo, SpcLink, 1)
|
|
} ASN1_SEQUENCE_END(SpcSpOpusInfo)
|
|
|
|
IMPLEMENT_ASN1_FUNCTIONS(SpcString)
|
|
IMPLEMENT_ASN1_FUNCTIONS(SpcSerializedObject)
|
|
IMPLEMENT_ASN1_FUNCTIONS(SpcLink)
|
|
IMPLEMENT_ASN1_FUNCTIONS(SpcAttributeTypeAndOptionalValue)
|
|
IMPLEMENT_ASN1_FUNCTIONS(SpcPeImageData)
|
|
IMPLEMENT_ASN1_FUNCTIONS(AlgorithmIdentifier)
|
|
IMPLEMENT_ASN1_FUNCTIONS(DigestInfo)
|
|
IMPLEMENT_ASN1_FUNCTIONS(SpcIndirectDataContent)
|
|
IMPLEMENT_ASN1_FUNCTIONS(SpcSpOpusInfo)
|