andreacristaldi-DefenderRuleParser/Parsers/FilePathParser.cs

// DefenderRuleParser
// Author: Andrea Cristaldi 2025 - https://github.com/andreacristaldi/DefenderRuleParser
// This project is licensed under the Apache 2.0 License.
/*
 * Summary: Extracts generic file paths from signature payloads (non-ASEP specific).
 * Origin: dump-driven; ASCII/UTF-16 runs identified heuristically.
 * Role: Normalizes and deduplicates paths for later export.
 */
using DefenderRuleParser2;
using DefenderRuleParser2.Models;
using DefenderRuleParser2.Parsers.Wildcards; 
using System;
using System.Collections.Generic;
using System.IO;
using System.Text;

namespace DefenderRuleParser2.Parsers
{
    
    public class FilePathParser : ISignatureParser
    {
        public void Parse(BinaryReader reader, int size, uint threatId)
        {
            long offset = reader.BaseStream.Position;

            try
            {
                byte[] buffer = reader.ReadBytes(size);
                if (buffer == null || buffer.Length < 2)
                {
                    Logger.Info("[FILEPATH] ❗ Signature too short.");
                    return;
                }

                using (var ms = new MemoryStream(buffer))
                using (var br = new BinaryReader(ms))
                {
                    ushort threshold = br.ReadUInt16();
                    byte[] payload = ReadRest(br);

                    
                    bool isWild = LooksLikeWildcardPattern(payload);

                    string humanOut;
                    if (isWild)
                    {
                        int consumed;
                        bool hadTerm;
                        var tokens = WildcardPattern.Tokenize(payload, 0, payload.Length, out consumed, out hadTerm);

                        
                        string human = WildcardPattern.RenderHuman(tokens, Encoding.ASCII);
                        string yara = WildcardPattern.RenderYaraHex(tokens);

                        
                        var sbAscii = new StringBuilder();
                        for (int i = 0; i < tokens.Count; i++)
                        {
                            var lit = tokens[i] as TokLiteral;
                            if (lit != null && lit.Bytes != null && lit.Bytes.Length > 0)
                                sbAscii.Append(Encoding.ASCII.GetString(lit.Bytes));
                        }
                        string asciiOnly = sbAscii.ToString();

                        Logger.Info(string.Format("[FILEPATH] Threat ID: {0}, Threshold: {1} (wildcarded)", threatId, threshold));
                        if (!string.IsNullOrEmpty(asciiOnly)) Logger.Info("  · ASCII-only : " + asciiOnly);
                        if (!string.IsNullOrEmpty(human)) Logger.Info("  · WILD/Human : " + human);
                        if (!string.IsNullOrEmpty(yara)) Logger.Info("  · WILD/YARA  : " + yara);

                        humanOut = !string.IsNullOrEmpty(human) ? human : asciiOnly;
                    }
                    else
                    {
                        
                        string filePath = DecodeBestEffort(payload);

                        Logger.Info(string.Format("[FILEPATH] Threat ID: {0}, Threshold: {1}", threatId, threshold));
                        Logger.Info("  > Path:   " + filePath);

                        humanOut = filePath;
                    }

                    if (!string.IsNullOrWhiteSpace(humanOut) && ThreatDatabase.TryGetThreat(threatId, out var threat))
                    {
                        threat.Signatures.Add(new SignatureEntry
                        {
                            Type = "SIGNATURE_TYPE_FILEPATH",
                            Offset = offset,
                            Pattern = new List<string> { humanOut },
                            Parsed = true,
                            ConditionType = (threshold > 1) ? "MIN_MATCHES" : "PRESENT",
                            ConditionValue = Math.Max(1, (int)threshold)
                        });
                    }
                }
            }
            catch (Exception ex)
            {
                Logger.Error(string.Format("[!] FILEPATH Error parsing at offset 0x{0:X}: {1}", offset, ex.Message));
            }
            finally
            {
                reader.BaseStream.Seek(offset + size, SeekOrigin.Begin);
            }
        }

        // ---------- helpers ----------

        private static byte[] ReadRest(BinaryReader br)
        {
            int left = (int)(br.BaseStream.Length - br.BaseStream.Position);
            if (left <= 0) return new byte[0];
            return br.ReadBytes(left);
        }

        
        private static bool LooksLikeWildcardPattern(byte[] data)
        {
            if (data == null || data.Length < 2) return false;
            for (int i = 0; i < data.Length - 1; i++)
            {
                if (data[i] != 0x90) continue;
                byte n = data[i + 1];
                if (n == 0x00 || n == 0x90 || n < 0x32) return true;
            }
            return false;
        }

        
        private static string DecodeBestEffort(byte[] bytes)
        {
            if (bytes == null || bytes.Length == 0) return string.Empty;

            int nullOdd = 0;
            for (int i = 1; i < bytes.Length; i += 2)
                if (bytes[i] == 0x00) nullOdd++;

            bool utf16 = (bytes.Length >= 4) && (nullOdd >= bytes.Length / 4);
            string s = utf16 ? Encoding.Unicode.GetString(bytes) : Encoding.UTF8.GetString(bytes);
            return s.TrimEnd('\0').Trim();
        }
    }
}