more software signatures #1301
more software signatures #1301
Conversation
jstucke
commented
Nov 18, 2024
jstucke
commented
- added some software signatures (mbed TLS, file, opkg)
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #1301 +/- ##
==========================================
- Coverage 92.42% 92.01% -0.42%
==========================================
Files 379 378 -1
Lines 23661 21469 -2192
==========================================
- Hits 21869 19754 -2115
+ Misses 1792 1715 -77 ☔ View full report in Codecov by Sentry. |
|
Can you document somewhere (commit message/code comments), why these signatures are correct? |
jstucke
force-pushed
the
software-signatures
branch
from
7696794 to
4e854ef
Compare
I tried to find the corresponding places in the source code but I also found that in libmagic the version is stored as an integer instead of a string. The FSR currently does not have the capability to extract integers, so I added it. |
jstucke
force-pushed
the
software-signatures
branch
from
4e854ef to
08eb5b6
Compare
src/plugins/analysis/software_components/code/software_components.py
Outdated
Show resolved
Hide resolved
|
Does this need a rebase after #1263? |
and also added a substitution option for software signatures to change the format (e.g. add dots)
jstucke
force-pushed
the
software-signatures
branch
from
08eb5b6 to
2fce538
Compare
I don't think so, since the PR didn't change any internals, but I did one anyway. |
| def _convert_version_str(self, version_str: str, meta_dict: dict): | ||
| """ | ||
| The metadata entry "_sub_regex" can be used to change the version string if it does not have the expected | ||
| format (e.g. add dots). The entry should contain a regex and replacement for `re.sub()` as JSON string | ||
| """ | ||
| try: | ||
| sub_regex, replacement = json.loads(meta_dict['_sub_regex']) | ||
| return re.sub(sub_regex, replacement, version_str) | ||
| except json.JSONDecodeError: | ||
| logging.warning(f'[{self.NAME}]: signature has invalid substitution regex: {meta_dict}') | ||
| return '' |
There was a problem hiding this comment.
This function should not take the meta_dict but rather the regex as parameter.
Also storing a python regex as json encoded array in a yara file seems a bit too complex to me (As can be seen by the amount of backslashes).
What do you think about formatting it in two separate fields:
rule file_libmagic {
meta:
software_name = "file"
// versions are stored as decimal int with three digits
// (first digit: major version, remaining two digits: minor version)
version_regex = "\\d{3}"
_version_function = "magic_version"
_sub_regex = "(\\d)(\\d{2})"
_sub_replacement = "\\1.\\2"
...
}There was a problem hiding this comment.
Also, what is the difference between the version_regex and the _sub_regex?
Could (should?) they be merged?
There was a problem hiding this comment.
version_regex is for reading in the version from the matched string (if it doesn't have the default 1.2.3 form) and _sub_regex (short for substitution regex) is something new that I had to think of, because file/libmagic came with a version in the form XYY (e.g. 524) and there is no way to read this in as X.YY without it. _sub_regex and _sub_replacement are the inputs for re.sub()
Why is XYY not enough in this case? Because it is stored as X.YY in the CVE data and we cannot match it otherwise
| if function is not None: | ||
| body = function.getBody() | ||
| instruction_iterator = currentProgram.getListing().getInstructions(body, True) | ||
|
|
||
| for instruction in instruction_iterator: | ||
| for i in range(instruction.getNumOperands()): | ||
| for operand in instruction.getOpObjects(i): | ||
| try: | ||
| value = operand.getValue() | ||
| except AttributeError: | ||
| continue | ||
| if value is not None and isinstance(value, (int, long)): | ||
| constants.append(str(value)) | ||
| return constants |
There was a problem hiding this comment.
Nit: I personally prefer less indentation, which in this case can be archived by adding:
if function is None:
return []Also: Why can function be none if we did not get an exception in the call to getGlobalFunctions?!
I think it cannot.
| """ | ||
| try: | ||
| function = getGlobalFunctions(function_name)[0] | ||
| except (IndexError, TypeError): |
There was a problem hiding this comment.
Why does this raise a type error?
