andreacristaldi-DefenderRuleParser/Parsers/Polyvir32Parser.cs

// DefenderRuleParser
// Author: Andrea Cristaldi 2025 - https://github.com/andreacristaldi/DefenderRuleParser
// This project is licensed under the Apache 2.0 License.
/*
 * Summary: Parser for POLYVIR32-like polymorphic records.
 * Origin: dump-driven; field boundaries inferred from recurring frames in dumps.
 * Role: Emits frame summaries and highlights variant sections.
 */
using System;
using System.Collections.Generic;
using System.IO;
using DefenderRuleParser2.Models;

namespace DefenderRuleParser2.Parsers
{
    public class Polyvir32Parser : ISignatureParser
    {
        public void Parse(BinaryReader reader, int size, uint threatId)
        {
            long offset = reader.BaseStream.Position;
            var entries = new List<string>();

            try
            {
                byte[] buffer = reader.ReadBytes(size);

                if (buffer.Length < 16 || buffer.Length % 16 != 0)
                {
                    Logger.Warn($"[POLYVIR32] ! Unusual structure size: {buffer.Length} bytes (expected multiple of 16)");
                }

                for (int i = 0; i + 16 <= buffer.Length; i += 16)
                {
                    byte[] chunk = new byte[16];
                    Array.Copy(buffer, i, chunk, 0, 16);

                    string hexLine = BitConverter.ToString(chunk).Replace("-", " ");
                    entries.Add(hexLine);
                }

                Logger.Info($"[POLYVIR32] Threat ID: {threatId}, Entries: {entries.Count}");
                foreach (var line in entries)
                    Logger.Info("  > " + line);

                if (ThreatDatabase.TryGetThreat(threatId, out var threat))
                {
                    threat.Signatures.Add(new SignatureEntry
                    {
                        Type = "SIGNATURE_TYPE_POLYVIR32",
                        Offset = offset,
                        Pattern = entries,
                        Parsed = true,
                        ConditionType = "PRESENT",
                        ConditionValue = 1
                    });
                }
            }
            catch (Exception ex)
            {
                Logger.Error($"[!] POLYVIR32 Error parsing at offset 0x{offset:X}: {ex.Message}");
            }
            finally
            {
                reader.BaseStream.Seek(offset + size, SeekOrigin.Begin);
            }
        }
    }
}