From 7b7f22a91d68b42cc0bfa8519f1c3b7878a360b6 Mon Sep 17 00:00:00 2001
From: Takahiro Haruyama <takahiro.haruyama@gmail.com>
Date: Wed, 1 Nov 2023 09:06:11 +0900
Subject: [PATCH] Add a firmware-access driver yara rule

---
 yara/hardware_io_wdf.yara | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100755 yara/hardware_io_wdf.yara

diff --git a/yara/hardware_io_wdf.yara b/yara/hardware_io_wdf.yara
new file mode 100755
index 0000000..bf26b63
--- /dev/null
+++ b/yara/hardware_io_wdf.yara
@@ -0,0 +1,20 @@
+import "pe"
+
+rule hardware_io_wdf {
+  meta:
+    description = "Designed to catch WDF x64 kernel drivers importing a memory-mapped I/O API (MmMapIoSpace)"
+
+  strings:
+	$wdf_api_name = "WdfVersionBind"
+    
+  condition:
+    filesize < 1MB and
+    uint16(0) == 0x5a4d and pe.machine == pe.MACHINE_AMD64 and 
+    (pe.imports("ntoskrnl.exe", "MmMapIoSpace") or pe.imports("ntoskrnl.exe", "MmMapIoSpaceEx")) and
+    $wdf_api_name and // WDF
+    //not $wdf_api_name and // WDM
+    for all signature in pe.signatures:
+    (
+	  not signature.subject contains "WDKTestCert"
+    )
+}