admin/stellarbear-YaraSharp
1
0
Fork 0
mirror of https://github.com/stellarbear/YaraSharp synced 2026-06-08 17:36:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix external variables issue. Moved from yr_rules_scan_* to yr_scannner_scan_*

Browse Source
This commit is contained in:
stellarbear
2018-04-19 11:42:42 +03:00
parent 9f25d534b6
commit 47cfc5c4aa
10 changed files with 75 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+3
View File
@@ -1,6 +1,9 @@
## Ignore Visual Studio temporary files, build results, and
## files generated by popular Visual Studio add-ons.
# Signatures
*.yar
# User-specific files
*.suo
*.user
Build/Test/YaraSharp.dll
BIN
View File
Binary file not shown.
Build/Test/YaraTest.exe
BIN
View File
Binary file not shown.
README.md
+4 -2
View File
@@ -1,7 +1,7 @@
# YaraSharp
C# wrapper around the Yara pattern matching library.
C# wrapper around the [Yara pattern matching library](https://github.com/VirusTotal/yara).
Included signatures form [Loki](https://github.com/Neo23x0/signature-base/tree/master/yara).
Use signatures form [Loki](https://github.com/Neo23x0/signature-base/tree/master/yara).
## Usage
```C#
// All API calls happens here
@@ -77,6 +77,8 @@ Soultion contains 2 projects:
## Other
Build in vs 2017
Compiled with yara 3.7.0
You can use or modify the sources however you want
Special thanks to [kallanreed](https://github.com/kallanreed/libyara.NET)
YaraSharp/Compiler.cpp
+9 -12
View File
@@ -18,15 +18,7 @@ namespace YaraSharp
// Destructor
CCompiler::~CCompiler() { if (Compiler) yr_compiler_destroy(Compiler); }
void CCompiler::SetCompilerCallback()
{
YaraCompilerCallback^ CompilerCallback = gcnew YaraCompilerCallback(this, &CCompiler::HandleCompilerCallback);
GCHandle CallbackHandle = GCHandle::Alloc(CompilerCallback);
YR_COMPILER_CALLBACK_FUNC CallbackPointer = (YR_COMPILER_CALLBACK_FUNC)(Marshal::GetFunctionPointerForDelegate(CompilerCallback)).ToPointer();
yr_compiler_set_callback(Compiler, CallbackPointer, NULL);
}
// Add a single rule
// Rule region
int CCompiler::AddFile(String^ FilePath)
{
FILE* File;
@@ -44,13 +36,11 @@ namespace YaraSharp
return errors;
}
// Add several files
void CCompiler::AddFiles(List<String^>^ FilePathList)
{
for each (auto FilePath in FilePathList)
AddFile(FilePath);
}
// Get rule list
CRules^ CCompiler::GetRules()
{
YR_RULES* Rules;
@@ -60,11 +50,11 @@ namespace YaraSharp
return gcnew CRules(Rules);
}
// Get error list
List<String^>^ CCompiler::GetErrors()
{
return this->Errors;
}
// Set externals
void CCompiler::SetCompilerExternals(Dictionary<String^, Object^>^ ExternalVariables)
{
@@ -96,6 +86,13 @@ namespace YaraSharp
}
// Callback
void CCompiler::SetCompilerCallback()
{
YaraCompilerCallback^ CompilerCallback = gcnew YaraCompilerCallback(this, &CCompiler::HandleCompilerCallback);
GCHandle CallbackHandle = GCHandle::Alloc(CompilerCallback);
YR_COMPILER_CALLBACK_FUNC CallbackPointer = (YR_COMPILER_CALLBACK_FUNC)(Marshal::GetFunctionPointerForDelegate(CompilerCallback)).ToPointer();
yr_compiler_set_callback(Compiler, CallbackPointer, NULL);
}
void CCompiler::HandleCompilerCallback(int ErrorLevel, const char* Filename, int LineNumber, const char* Message, void* UserData)
{
UNREFERENCED_PARAMETER(ErrorLevel);
YaraSharp/Scanner.cpp
+31 -6
View File
@@ -10,10 +10,33 @@ namespace YaraSharp
ErrorUtility::ThrowOnError(yr_scanner_create((YR_RULES*)rules, &TestScanner));
Scanner = TestScanner;
Matches = gcnew List<CMatches^>();
// TODO: add timeout support
SetScannerExternals(ExternalVariables);
SetScannerCallback();
}
// Destructor
CScanner::~CScanner() { if (Scanner) yr_scanner_destroy(Scanner); }
// Scan region
List<CMatches^>^ CScanner::ScanProcess(int PID)
{
ErrorUtility::ThrowOnError(yr_scanner_scan_proc(Scanner, PID));
return Matches;
}
List<CMatches^>^ CScanner::ScanFile(String^ Path)
{
ErrorUtility::ThrowOnError(yr_scanner_scan_file(Scanner,
(marshal_as<std::string>(Path)).c_str()));
return Matches;
}
List<CMatches^>^ CScanner::ScanMemory(uint8_t* Buffer, int Length)
{
ErrorUtility::ThrowOnError(yr_scanner_scan_mem(Scanner, Buffer, Length));
return Matches;
}
// Set externals
void CScanner::SetScannerExternals(Dictionary<String^, Object^>^ ExternalVariables)
@@ -46,15 +69,17 @@ namespace YaraSharp
}
// Callback
void CScanner::SetScannerCallback()
{
YaraScanCallback^ ScannerCallback = gcnew YaraScanCallback(this, &CScanner::HandleScannerCallback);
GCHandle CallbackHandle = GCHandle::Alloc(ScannerCallback);
YR_CALLBACK_FUNC CallbackPointer = (YR_CALLBACK_FUNC)Marshal::GetFunctionPointerForDelegate(ScannerCallback).ToPointer();
yr_scanner_set_callback(Scanner, CallbackPointer, NULL);
}
int CScanner::HandleScannerCallback(int message, void* data, void* context)
{
if (message == CALLBACK_MSG_RULE_MATCHING)
{
auto resultsHandle = GCHandle::FromIntPtr(IntPtr(context));
auto results = (List<CMatches^>^)resultsHandle.Target;
results->Add(gcnew CMatches((YR_RULE*)data));
}
Matches->Add(gcnew CMatches((YR_RULE*)data));
return CALLBACK_CONTINUE;
}
YaraSharp/Scanner.h
+5
View File
@@ -8,13 +8,18 @@ namespace YaraSharp
public ref class CScanner sealed
{
initonly YR_SCANNER * Scanner;
List<CMatches^>^ Matches;
public:
CScanner(CRules^ rules, Dictionary<String^, Object^>^ ExternalVariables);
~CScanner();
List<CMatches^>^ ScanProcess(int PID);
List<CMatches^>^ ScanFile(String^ Path);
List<CMatches^>^ ScanMemory(uint8_t* Buffer, int Length);
int HandleScannerCallback(int Message, void* Data, void* Context);
private:
void SetScannerCallback();
void SetScannerExternals(Dictionary<String^, Object^>^ ExternalVariables);
};
}
YaraSharp/YaraSharp.cpp
+20 -52
View File
@@ -46,8 +46,7 @@ namespace YaraSharp
return CompilationErrors;
}
// Rule compilation
CRules^ CYaraSharp::CompileFromFiles(List<String^>^ FilePathList, Dictionary<String^, Object^>^ ExternalVariables,
[Out] Dictionary<String^, List<String^>^>^% CompilationErrors)
@@ -66,50 +65,38 @@ namespace YaraSharp
// Return compiled rules
return Result;
}
// Scanning file
// Scanning region
List<CMatches^>^ CYaraSharp::ScanFile(String^ Path, CRules^ Rules, Dictionary<String^, Object^>^ ExternalVariables, int Timeout)
{
CScanner^ FScanner = gcnew CScanner(Rules, ExternalVariables);
// File existance check disabled. This cause crashes on long filenames (260+ symbols)
//if (!File::Exists(Path))
// throw gcnew FileNotFoundException(Path);
// Callback section
List<CMatches^>^ Results = gcnew List<CMatches^>();
GCHandle ResultsHandle = GCHandle::Alloc(Results);
void* ResultsPointer = GCHandle::ToIntPtr(ResultsHandle).ToPointer();
YaraScanCallback^ ScannerCallback = gcnew YaraScanCallback(FScanner, &CScanner::HandleScannerCallback);
GCHandle CallbackHandle = GCHandle::Alloc(ScannerCallback);
YR_CALLBACK_FUNC CallbackPointer = (YR_CALLBACK_FUNC)Marshal::GetFunctionPointerForDelegate(ScannerCallback).ToPointer();
// Scanning
ErrorUtility::ThrowOnError(yr_rules_scan_file(Rules, (marshal_as<std::string>(Path)).c_str(), 0, CallbackPointer, ResultsPointer, Timeout));
List<CMatches^>^ Results = FScanner->ScanFile(Path);
delete FScanner;
return Results;
}
// Scanning process (not yet tested)
List<CMatches^>^ CYaraSharp::ScanProcess(int PID, CRules^ Rules, int Timeout, Dictionary<String^, Object^>^ ExternalVariables)
// (not yet tested)
List<CMatches^>^ CYaraSharp::ScanProcess(int PID, CRules^ Rules, Dictionary<String^, Object^>^ ExternalVariables, int Timeout)
{
CScanner^ PScanner = gcnew CScanner(Rules, ExternalVariables);
// Callback section
List<CMatches^>^ Results = gcnew List<CMatches^>();
GCHandle ResultsHandle = GCHandle::Alloc(Results);
void* ResultsPointer = GCHandle::ToIntPtr(ResultsHandle).ToPointer();
YaraScanCallback^ ScannerCallback = gcnew YaraScanCallback(PScanner, &CScanner::HandleScannerCallback);
GCHandle CallbackHandle = GCHandle::Alloc(ScannerCallback);
YR_CALLBACK_FUNC CallbackPointer = (YR_CALLBACK_FUNC)Marshal::GetFunctionPointerForDelegate(ScannerCallback).ToPointer();
// Scanning
ErrorUtility::ThrowOnError(yr_rules_scan_proc(Rules, PID, 0, CallbackPointer, ResultsPointer, Timeout));
List<CMatches^>^ Results = PScanner->ScanProcess(PID);
delete PScanner;
return Results;
}
// Scanning memory (not yet tested)
// (not yet tested)
List<CMatches^>^ CYaraSharp::ScanMemory(uint8_t* Buffer, int Length, CRules^ Rules, Dictionary<String^, Object^>^ ExternalVariables, int Timeout)
{
CScanner^ MScanner = gcnew CScanner(Rules, ExternalVariables);
List<CMatches^>^ Results = MScanner->ScanMemory(Buffer, Length);
delete MScanner;
return Results;
}
// (not yet tested)
List<CMatches^>^ CYaraSharp::ScanMemory(array<uint8_t>^ Buffer, CRules^ Rules, Dictionary<String^, Object^>^ ExternalVariables, int Timeout)
{
if (Buffer == nullptr || Buffer->Length == 0)
@@ -120,23 +107,4 @@ namespace YaraSharp
return ScanMemory(BufferPointer, Buffer->Length, Rules, ExternalVariables, Timeout);
}
}
// Scanning memory (not yet tested)
List<CMatches^>^ CYaraSharp::ScanMemory(uint8_t* Buffer, int Length, CRules^ Rules, Dictionary<String^, Object^>^ ExternalVariables, int Timeout)
{
CScanner^ MScanner = gcnew CScanner(Rules, ExternalVariables);
// Callback section
List<CMatches^>^ Results = gcnew List<CMatches^>();
GCHandle ResultsHandle = GCHandle::Alloc(Results);
void* ResultsPointer = GCHandle::ToIntPtr(ResultsHandle).ToPointer();
YaraScanCallback^ ScannerCallback = gcnew YaraScanCallback(MScanner, &CScanner::HandleScannerCallback);
GCHandle CallbackHandle = GCHandle::Alloc(ScannerCallback);
YR_CALLBACK_FUNC CallbackPointer = (YR_CALLBACK_FUNC)Marshal::GetFunctionPointerForDelegate(ScannerCallback).ToPointer();
// Scanning
ErrorUtility::ThrowOnError(yr_rules_scan_mem(Rules, Buffer, Length, 0, CallbackPointer, ResultsPointer, Timeout));
return Results;
}
}
YaraSharp/YaraSharp.h
+1 -1
View File
@@ -13,7 +13,7 @@ namespace YaraSharp
[Out] Dictionary<String^, List<String^>^>^% CompilationErrors);
List<CMatches^>^ ScanFile(String^ Path, CRules^ Rules, Dictionary<String^, Object^>^ ExternalVariables, int Timeout);
List<CMatches^>^ ScanProcess(int PID, CRules^ Rules, int Timeout, Dictionary<String^, Object^>^ ExternalVariables);
List<CMatches^>^ ScanProcess(int PID, CRules^ Rules, Dictionary<String^, Object^>^ ExternalVariables, int Timeout);
List<CMatches^>^ ScanMemory(array<uint8_t>^ Buffer, CRules^ Rules, Dictionary<String^, Object^>^ ExternalVariables, int Timeout);
List<CMatches^>^ ScanMemory(uint8_t* Buffer, int Length, CRules^ Rules, Dictionary<String^, Object^>^ ExternalVariables, int Timeout);
};
YaraTest/Program.cs
+2 -2
View File
@@ -11,7 +11,7 @@ namespace YaraTest
static void Main(string[] args)
{
// All API calls happens here
YaraSharp.CYaraSharp YSInstance = new CYaraSharp();
YaraSharp.CYaraSharp YSInstance = new CYaraSharp();
// Declare external variables (could be null)
Dictionary<string, object> Externals = new Dictionary<string, object>()
@@ -32,7 +32,7 @@ namespace YaraTest
using (YaraSharp.CRules YSRules = YSInstance.CompileFromFiles(Directory.GetFiles(Path.Combine(Directory.GetCurrentDirectory(), "..\\..\\signatures"), "*.yar", SearchOption.AllDirectories).ToList(), Externals, out Errors))
{
// Some file to test yara rules
string Filename = @"\\?\D:\test\MW vol 5.0.rar";
string Filename = @"\\?\D:\_\Magic.apt";
// Get matches
List<YaraSharp.CMatches> Matches = YSInstance.ScanFile(Filename, YSRules,