andreacristaldi-DefenderRuleParser/Parsers/NdatParser.cs

// DefenderRuleParser
// Author: Andrea Cristaldi 2025 - https://github.com/andreacristaldi/DefenderRuleParser
// This project is licensed under the Apache 2.0 License.
/*
 * Summary: NSCRIPT “cure” variant parser (clean-up/remediation recipes).
 * Origin: dump-driven; step codes and parameters inferred from dumps.
 * Role: Presents steps as readable pseudo-operations without execution semantics.
 */
using System;
using System.Collections.Generic;
using System.IO;
using System.Text;
using DefenderRuleParser2.Models;

namespace DefenderRuleParser2.Parsers
{
    public class NdatParser : ISignatureParser
    {
        public void Parse(BinaryReader reader, int size, uint threatId)
        {
            long offset = reader.BaseStream.Position;

            try
            {
                byte[] data = reader.ReadBytes(size);
                if (data.Length < 6)
                {
                    Logger.Warn($"[NDAT] ! Signature too short ({data.Length} bytes)");
                    return;
                }

                // Intestazione (4 byte)
                uint header = BitConverter.ToUInt32(data, 0);

                // Considera tutto tra [4] e [size - 2] come pattern
                int patternLength = size - 6;
                string pattern = Encoding.UTF8.GetString(data, 4, patternLength).TrimEnd('\0');

                Logger.Info($"[NDAT] Threat ID: {threatId}, Size: {size} bytes");
                Logger.Info($"  > Header: 0x{header:X8}");
                Logger.Info($"  > Pattern: {pattern}");

                if (ThreatDatabase.TryGetThreat(threatId, out var threat))
                {
                    threat.Signatures.Add(new SignatureEntry
                    {
                        Type = "SIGNATURE_TYPE_NDAT",
                        Offset = offset,
                        Pattern = new List<string> { pattern },
                        Parsed = true,
                        ConditionType = "MATCH_REGEX",
                        ConditionValue = 1
                    });
                }
            }
            catch (Exception ex)
            {
                Logger.Error($"[!] NDAT Error parsing at offset 0x{offset:X}: {ex.Message}");
            }
            finally
            {
                reader.BaseStream.Seek(offset + size, SeekOrigin.Begin);
            }
        }
    }


}