diff --git a/lib/libimhex/include/hex/helpers/fs.hpp b/lib/libimhex/include/hex/helpers/fs.hpp index 11fc4bd99..88a5aa46e 100644 --- a/lib/libimhex/include/hex/helpers/fs.hpp +++ b/lib/libimhex/include/hex/helpers/fs.hpp @@ -37,6 +37,7 @@ namespace hex::fs { Magic, Plugins, Yara, + YaraAdvancedAnalysis, Config, Backups, Resources, diff --git a/lib/libimhex/source/helpers/fs.cpp b/lib/libimhex/source/helpers/fs.cpp index 42e807eba..7a4364cf0 100644 --- a/lib/libimhex/source/helpers/fs.cpp +++ b/lib/libimhex/source/helpers/fs.cpp @@ -410,6 +410,9 @@ namespace hex::fs { case ImHexPath::Yara: result = appendPath(getDataPaths(), "yara"); break; + case ImHexPath::YaraAdvancedAnalysis: + result = appendPath(getDefaultPaths(ImHexPath::Yara), "advanced_analysis"); + break; case ImHexPath::Recent: result = appendPath(getConfigPaths(), "recent"); break; diff --git a/plugins/yara_rules/romfs/rules/compiler.yar b/plugins/yara_rules/romfs/rules/compiler.yar deleted file mode 100644 index e1894d5b4..000000000 --- a/plugins/yara_rules/romfs/rules/compiler.yar +++ /dev/null @@ -1,40 +0,0 @@ -rule CompilerMSVC { - meta: - category = "Compiler" - name = "MSVC" - - strings: - $iostreams_mangled_name = "$basic_iostream@DU" ascii - $std_namespace = "@@std@@" ascii - - condition: - any of them -} - -rule CompilerGCC { - meta: - category = "Compiler" - name = "GCC" - - strings: - $iostreams_mangled_name = "_ZSt4cout" ascii - $std_namespace = "_ZSt" ascii - $gcc_version = "GCC: (GNU) " ascii - - condition: - 2 of them -} - -rule CompilerClang { - meta: - category = "Compiler" - name = "Clang" - - strings: - $iostreams_mangled_name = "_ZSt4cout" ascii - $std_namespace = "_ZSt" ascii - $clang_version = "clang version " ascii - - condition: - 2 of them -} \ No newline at end of file diff --git a/plugins/yara_rules/romfs/rules/environment.yar b/plugins/yara_rules/romfs/rules/environment.yar deleted file mode 100644 index 799b1898b..000000000 --- a/plugins/yara_rules/romfs/rules/environment.yar +++ /dev/null @@ -1,36 +0,0 @@ -rule EnvironmentMingw { - meta: - category = "Environment" - name = "MinGW" - - strings: - $mingw_runtime = "Mingw runtime failure" ascii - $mingw64_runtime = "Mingw-w64 runtime failure:" ascii fullword - $msys2 = "Built by MSYS2 project" ascii - - condition: - 2 of them -} - -rule EnvironmentWin32 { - meta: - category = "Environment" - name = "Win32" - - strings: - $kernel32 = "KERNEL32.dll" ascii - $user32 = "USER32.dll" ascii - $advapi32 = "ADVAPI32.dll" ascii - $ole32 = "OLE32.dll" ascii - $oleaut32 = "OLEAUT32.dll" ascii - $shell32 = "SHELL32.dll" ascii - $shlwapi = "SHLWAPI.dll" ascii - $comctl32 = "COMCTL32.dll" ascii - $comdlg32 = "COMDLG32.dll" ascii - $gdi32 = "GDI32.dll" ascii - $imm32 = "IMM32.dll" ascii - $msvcrt = "MSVCRT.dll" ascii - - condition: - 4 of them -} \ No newline at end of file diff --git a/plugins/yara_rules/romfs/rules/language.yar b/plugins/yara_rules/romfs/rules/language.yar deleted file mode 100644 index 0fbc0379d..000000000 --- a/plugins/yara_rules/romfs/rules/language.yar +++ /dev/null @@ -1,61 +0,0 @@ -rule LanguageCpp { - meta: - category = "Programming Language" - name = "C++" - - strings: - $exception_windows = "_CxxThrowException" ascii fullword - $iostreams = "iostream" ascii - - condition: - any of them -} - -rule LanguageC { - meta: - category = "Programming Language" - name = "C++" - - strings: - $printf = "printf" ascii - $scanf = "scanf" ascii - $malloc = "malloc" ascii - $calloc = "calloc" ascii - $realloc = "realloc" ascii - $free = "free" ascii - - condition: - any of them and not LanguageCpp -} - -rule LanguageRust { - meta: - category = "Programming Language" - name = "Rust" - - strings: - $option_unwrap = "called `Option::unwrap()` on a `None`" ascii - $result_unwrap = "called `Result::unwrap()` on an `Err`" ascii - $panic_1 = "panicked at" ascii - $panic_2 = "thread '' panicked at" ascii - $panic_3 = "thread panicked while processing panic. aborting." ascii - $panicking_file = "panicking.rs" ascii fullword - - condition: - any of them -} - -rule LanguageGo { - meta: - category = "Programming Language" - name = "Go" - - strings: - $max_procs = "runtime.GOMAXPROCS" ascii fullword - $panic = "runtime.gopanic" ascii fullword - $go_root = "runtime.GOROOT" ascii fullword - - condition: - any of them - -} \ No newline at end of file diff --git a/plugins/yara_rules/source/content/data_information_sections.cpp b/plugins/yara_rules/source/content/data_information_sections.cpp index 91ba76401..c3f0a8dd1 100644 --- a/plugins/yara_rules/source/content/data_information_sections.cpp +++ b/plugins/yara_rules/source/content/data_information_sections.cpp @@ -27,29 +27,28 @@ namespace hex::plugin::yara { }; void process(Task &task, prv::Provider *provider, Region region) override { - const auto &ruleFilePaths = romfs::list("rules"); - task.setMaxValue(ruleFilePaths.size()); + for (const auto &yaraSignaturePath : fs::getDefaultPaths(fs::ImHexPath::YaraAdvancedAnalysis)) { + for (const auto &ruleFilePath : std::fs::recursive_directory_iterator(yaraSignaturePath)) { + const std::string fileContent = romfs::get(ruleFilePath).data(); - for (const auto &ruleFilePath : ruleFilePaths) { - const std::string fileContent = romfs::get(ruleFilePath).data(); + YaraRule yaraRule(fileContent); + task.setInterruptCallback([&yaraRule] { + yaraRule.interrupt(); + }); - YaraRule yaraRule(fileContent); - task.setInterruptCallback([&yaraRule] { - yaraRule.interrupt(); - }); + const auto result = yaraRule.match(provider, region); + if (result.has_value()) { + const auto &rules = result.value().matchedRules; + for (const auto &rule : rules) { + if (!rule.metadata.contains("category")) continue; - const auto result = yaraRule.match(provider, region); - if (result.has_value()) { - const auto &rules = result.value().matchedRules; - for (const auto &rule : rules) { - if (!rule.metadata.contains("category")) continue; - - const auto &categoryName = rule.metadata.at("category"); - m_categories[categoryName].matchedRules.insert(rule); + const auto &categoryName = rule.metadata.at("category"); + m_categories[categoryName].matchedRules.insert(rule); + } } - } - task.increment(); + task.update(); + } } }