-
Notifications
You must be signed in to change notification settings - Fork 30
/
scanner.rs
424 lines (392 loc) · 15.1 KB
/
scanner.rs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
use std::fs::File;
use std::marker::PhantomData;
use std::path::Path;
pub use yara_sys::scan_flags::*;
use crate::{compiler::CompilerVariableValue, errors::*, internals, Rule, rules::Rules};
pub use crate::internals::{CallbackMsg, CallbackReturn};
/// A wrapper around compiled [Rules], with its own set of external variables, flags and timeout.
///
/// Obtained from calling [`scanner`](crate::Rules::scanner) on a set of compiled [Rules].
///
/// Scanners are really useful in multi-threaded contexts: from a given set of Rules,
/// you can create as many Scanners as you want, and they can each have different
/// external variables defined, flags and timeout without affecting the rest of
/// the Scanners.
///
/// Contrary to compiling a new set of rules, Scanners are really lightweight to
/// create from already compiled rules.
///
/// A Scanner is bound to the lifetime of its Rules, so it can never outlive them.
///
/// # Example
///
/// ```
/// # use yara::Compiler;
/// let mut compiler = Compiler::new()?;
/// // You MUST declare external variables and default values at compile time.
/// compiler.define_variable("habitat", "land")?;
/// compiler.define_variable("is_cute", false)?;
/// compiler.add_rules_str(r#"rule is_ferris {
/// strings:
/// $rust = "rust" nocase
/// condition:
/// $rust and habitat == "ocean" and is_cute
/// }"#)?;
/// let rules = compiler.compile_rules().unwrap();
/// let mut scanner = rules.scanner().unwrap();
/// // You can then redefine the values you want, and other scanners won't be
/// // affected by it.
/// scanner.define_variable("habitat", "ocean").unwrap();
/// scanner.define_variable("is_cute", true).unwrap();
/// scanner.set_timeout(5);
/// let results = scanner.scan_mem("I love Rust!".as_bytes()).unwrap();
/// assert_eq!(1, results.len());
///
/// let is_ferris_rule = &results[0];
/// assert_eq!("is_ferris", is_ferris_rule.identifier);
/// assert_eq!(1, is_ferris_rule.strings.len());
///
/// let string = &is_ferris_rule.strings[0];
/// assert_eq!("$rust", string.identifier);
///
/// let m = &string.matches[0];
/// assert_eq!(7, m.offset);
/// assert_eq!(4, m.length);
/// assert_eq!(b"Rust", m.data.as_slice());
/// # Ok::<(), yara::Error>(())
/// ```
pub struct Scanner<'rules> {
inner: *mut yara_sys::YR_SCANNER,
rules: PhantomData<&'rules Rules>,
}
// On the subject of thread-safety:
// scanner_scan_XXX functions use 2 Thread Local Storage variables which would
// normally prevent the YR_SCANNER struct from being `Send` and `Sync`:
//
// * libyara.c:yr_tidx_key. This is a per-thread id allocated at the start of
// yr_scanner_scan_mem_blocks, which is used to index into various arrays during
// the scan. It is deallocated when yr_scanner_scan_mem_blocks returns.
// Because we do not let the user pass its own callback to scan_XXX, and because
// ours does not change thread or call .await, we know for a fact that there is
// no way for our execution flow to change thread during the call to a scan_XXX,
// hence having it Send is safe.
// * libyara.c:yr_recovery_state_key. Per thread longjmp context for internal error
// management inside libyara. Safe on the same basis as yr_tidx_key.
//
/// This is safe because Yara TLS have are short-lived and we control the callback,
/// ensuring we cannot change thread while they are defined.
unsafe impl<'a> std::marker::Send for Scanner<'a> {}
unsafe impl<'a> std::marker::Sync for Scanner<'a> {}
impl<'a> Scanner<'a> {
/// Creates a scanner bound to the lifetime of the Rules.
pub(crate) fn new(rules: &'a Rules) -> Result<Scanner<'a>, YaraError> {
// note: The scanner will inherit the external variables currently defined
// on the Rules by copying them, but because we provide no way to assign
// external variables directly on the Rules, this is not a concern for us.
Ok(Scanner {
inner: internals::scanner_create(rules.inner)?,
rules: PhantomData,
})
}
}
impl<'a> Drop for Scanner<'a> {
fn drop(&mut self) {
internals::scanner_destroy(self.inner);
}
}
impl<'rules> Scanner<'rules> {
/// Define an external variable for this scanner, without affecting the
/// rest of the scanners.
///
/// Note that the variable must have already been declared with the proper type
/// with [define_variable](crate::Compiler::define_variable) when compiling the rules.
pub fn define_variable<V: CompilerVariableValue>(
&mut self,
identifier: &str,
value: V,
) -> Result<(), YaraError> {
value.assign_in_scanner(self.inner, identifier)
}
/// Scan memory.
///
/// Returns a `Vec` of matching rules.
///
/// * `mem` - Slice to scan.
///
/// # Ownership
///
/// This funciton takes the Scanner as `&mut` because it modifies the
/// `scanner->callback` and `scanner->user_data`, which are not behind a Mutex.
pub fn scan_mem(&mut self, mem: &[u8]) -> Result<Vec<Rule<'rules>>, YaraError> {
let mut results: Vec<Rule> = Vec::new();
let callback = |message| {
if let internals::CallbackMsg::RuleMatching(rule) = message {
results.push(rule)
}
internals::CallbackReturn::Continue
};
self.scan_mem_callback(mem, callback).map(|_| results)
}
/// Scan memory with custom callback
///
/// Returns
///
/// * `mem` - Slice to scan
/// * `callback` - YARA callback mor read [here](https://yara.readthedocs.io/en/stable/capi.html#scanning-data)
///
/// # Ownership
///
/// This funciton takes the Scanner as `&mut` because it modifies the
/// `scanner->callback` and `scanner->user_data`, which are not behind a Mutex.
pub fn scan_mem_callback<'r>(
&mut self,
mem: &[u8],
callback: impl FnMut(CallbackMsg<'r>) -> CallbackReturn,
) -> Result<(), YaraError> {
internals::scanner_scan_mem(self.inner, mem, callback)
}
/// Scan a file.
///
/// Return a `Vec` of matching rules.
///
/// # Ownership
///
/// This function takes the Scanner as `&mut` because it modifies the
/// `scanner->callback` and `scanner->user_data`, which are not behind a Mutex.
pub fn scan_file<'r, P: AsRef<Path>>(&mut self, path: P) -> Result<Vec<Rule<'r>>, Error> {
let mut results: Vec<Rule> = Vec::new();
let callback = |message| {
if let internals::CallbackMsg::RuleMatching(rule) = message {
results.push(rule)
}
internals::CallbackReturn::Continue
};
self.scan_file_callback(path, callback).map(|_| results)
}
/// Scan file with custom callback
///
/// Returns
///
/// * `path` - Path to file
/// * `callback` - YARA callback mor read [here](https://yara.readthedocs.io/en/stable/capi.html#scanning-data)
///
/// # Ownership
///
/// This function takes the Scanner as `&mut` because it modifies the
/// `scanner->callback` and `scanner->user_data`, which are not behind a Mutex.
pub fn scan_file_callback<'r, P: AsRef<Path>>(
&mut self,
path: P,
callback: impl FnMut(CallbackMsg<'r>) -> CallbackReturn,
) -> Result<(), Error> {
File::open(path)
.map_err(|e| IoError::new(e, IoErrorKind::OpenScanFile).into())
.and_then(|file| {
internals::scanner_scan_file(self.inner, &file, callback).map_err(|e| e.into())
})
}
/// Attach a process, pause it, and scan its memory.
///
/// Return a `Vec` of matching rules.
///
/// # Permissions
///
/// You need to be able to attach to process `pid`.
///
/// # Ownership
///
/// This function takes the Scanner as `&mut` because it modifies the
/// `scanner->callback` and `scanner->user_data`, which are not behind a Mutex.
pub fn scan_process<'r>(&mut self, pid: u32) -> Result<Vec<Rule<'r>>, YaraError> {
let mut results: Vec<Rule> = Vec::new();
let callback = |message| {
if let internals::CallbackMsg::RuleMatching(rule) = message {
results.push(rule)
}
internals::CallbackReturn::Continue
};
self.scan_process_callback(pid, callback).map(|_| results)
}
/// Attach a process, pause it, and scan its memory.
///
/// Returns
///
/// * `pid` - Process id
/// * `callback` - YARA callback mor read [here](https://yara.readthedocs.io/en/stable/capi.html#scanning-data)
///
/// # Permissions
///
/// You need to be able to attach to process `pid`.
///
/// # Ownership
///
/// This function takes the Scanner as `&mut` because it modifies the
/// `scanner->callback` and `scanner->user_data`, which are not behind a Mutex.
pub fn scan_process_callback<'r>(
&mut self,
pid: u32,
callback: impl FnMut(CallbackMsg<'r>) -> CallbackReturn,
) -> Result<(), YaraError> {
internals::scanner_scan_proc(self.inner, pid, callback)
}
/// Set the maximum number of seconds that the scanner will spend in any call
/// to scan_xxx.
pub fn set_timeout(&mut self, seconds: u32) {
internals::scanner_set_timeout(self.inner, seconds as i32)
}
/// Set the flags that will be used by any call to scan_xxx .
pub fn set_flags(&mut self, flags: u32) {
internals::scanner_set_flags(self.inner, flags as i32)
}
}
#[cfg(test)]
mod test {
use std::{
io::Write,
process::{Command, Stdio},
};
use crate::Compiler;
static RULES: &str = r#"rule is_ferris {
strings:
$rust = "rust" nocase
condition:
$rust and habitat == "ocean" and life_expectancy <= 10 and size < 0.3 and is_cute
}
"#;
#[test]
fn external_vars_on_file() {
let mut compiler = Compiler::new().unwrap();
// You MUST declare external variables and default values at compile time.
compiler.define_variable("habitat", "land").unwrap();
compiler.define_variable("life_expectancy", 99).unwrap();
compiler.define_variable("size", 1.0_f64).unwrap();
compiler.define_variable("is_cute", false).unwrap();
compiler.add_rules_str(RULES).unwrap();
let rules = compiler.compile_rules().unwrap();
// Create two scanners, with different variable definitions:
// a crab, and a Rust gamer.
let mut scanner1 = rules.scanner().unwrap();
let mut scanner2 = rules.scanner().unwrap();
scanner1.define_variable("habitat", "ocean").unwrap();
scanner1.define_variable("life_expectancy", 5).unwrap();
scanner1.define_variable("size", 0.20_f64).unwrap();
scanner1.define_variable("is_cute", true).unwrap();
scanner1.set_timeout(5);
scanner2.define_variable("habitat", "his house").unwrap();
scanner2.define_variable("life_expectancy", 82).unwrap();
scanner2.define_variable("size", 1.75_f64).unwrap();
scanner2.define_variable("is_cute", false).unwrap();
scanner2.set_timeout(10);
let mut file = tempfile::NamedTempFile::new().expect("temp file creation to succeed");
file.write_all("I love Rust!".as_bytes())
.expect("write to tempfile to succeed");
let results1 = scanner1
.scan_file(
file.path()
.to_str()
.expect("tempfile path to be valid utf-8"),
)
.unwrap();
let results2 = scanner2
.scan_file(
file.path()
.to_str()
.expect("tempfile path to be valid utf-8"),
)
.unwrap();
assert_eq!(1, results1.len());
assert_eq!(0, results2.len());
let is_ferris_rule = &results1[0];
assert_eq!("is_ferris", is_ferris_rule.identifier);
assert_eq!(1, is_ferris_rule.strings.len());
let string = &is_ferris_rule.strings[0];
assert_eq!("$rust", string.identifier);
let m = &string.matches[0];
assert_eq!(7, m.offset);
assert_eq!(4, m.length);
assert_eq!(b"Rust", m.data.as_slice());
}
/// A random uuid that should be present in the process memory for the rule
/// to match.
static UUID_MATCH: &str = "401d67bf-ff9c-4632-992e-46afed0bbcff";
/// A random uuid that is unlikely to be present in the process' memory.
static UUID_NO_MATCH: &str = "db4f9dab-a622-4fc9-b71f-38398baf308b";
#[cfg(not(windows))]
static RULES_PROC: &str = r#"rule found_uuid {
strings:
$target = "401d67bf-ff9c-4632-992e-46afed0bbcff"
condition:
$target
}
"#;
#[cfg(windows)]
static RULES_PROC: &str = r#"rule found_uuid {
strings:
$target = "401d67bf-ff9c-4632-992e-46afed0bbcff" wide
condition:
$target
}
"#;
#[test]
fn scanner_scan_proc() {
let mut compiler = Compiler::new().unwrap();
compiler.add_rules_str(RULES_PROC).unwrap();
let rules = compiler.compile_rules().unwrap();
let mut scanner = rules.scanner().unwrap();
scanner.set_timeout(10);
// spawn two process, one which should match and one that should not
#[cfg(unix)]
let process_match = Command::new("sh")
.arg("-c")
.arg(format!("sleep 5; echo {}", UUID_MATCH))
.stdout(Stdio::null())
.spawn()
.unwrap();
#[cfg(unix)]
let process_no_match = Command::new("sh")
.arg("-c")
.arg(format!("sleep 5; echo {}", UUID_NO_MATCH))
.stdout(Stdio::null())
.spawn()
.unwrap();
#[cfg(windows)]
let process_match = Command::new("cmd")
.arg("/C")
.arg(format!("ping 127.0.0.1 -n 60 > nul & echo {}", UUID_MATCH))
.stdout(Stdio::null())
.spawn()
.unwrap();
#[cfg(windows)]
let process_no_match = Command::new("cmd")
.arg("/C")
.arg(format!(
"ping 127.0.0.1 -n 60 > nul & echo {}",
UUID_NO_MATCH
))
.stdout(Stdio::null())
.spawn()
.unwrap();
let results1 = scanner.scan_process(process_match.id()).unwrap();
let results2 = scanner.scan_process(process_no_match.id()).unwrap();
assert_eq!(1, results1.len());
assert_eq!(0, results2.len());
let found_uuid = &results1[0];
assert_eq!("found_uuid", found_uuid.identifier);
assert_eq!(1, found_uuid.strings.len());
for string in &found_uuid.strings {
assert_eq!("$target", string.identifier);
let bytes = if cfg!(windows) {
// the string is in utf-16 format, filter out the zeroes.
string.matches[0]
.data
.clone()
.into_iter()
.filter(|v| *v != 0)
.collect()
} else {
string.matches[0].data.clone()
};
assert_eq!(UUID_MATCH.as_bytes(), bytes);
}
}
}