yara 1.5.0 → 1.6.0

data/History.txt

@@ -1,7 +1,12 @@
+== 1.6.0 /2011-08-26
+  * Version 1.6.0 supports yara 1.6 - (backward compatible with yara v1.5)
+  * Note: Nothing actually changed in the API for yara 1.6, we are just keeping
+    step with yara's version numbers.
+
 == 1.5.0 /2011-04-18
   * Version 1.5.0 supports yara 1.5 - it is not backward compatible
 
-== 1.4.3 / 2011-04-11
+== 1.4.4 / 2011-04-11
   * Support optional namespaces when calling compile_file or compile_string
   * Better yardoc tags
 

data/VERSION

@@ -1 +1 @@
-1.5.0
+1.6.0

data/ext/yara_native/Match.c

@@ -57,6 +57,9 @@ const char * SCAN_ERRORS[] = {
   "duplicate meta identifier",
   "includes circular reference",
   "incorrect external variable type",
+  "could not attach to process",
+  "vector too long",
+  "include depth exceeded"
 };
 
 typedef struct {

data/ext/yara_native/Match.h

@@ -31,7 +31,7 @@ extern const char * SCAN_ERRORS[];
 
 void init_Match();
 
-#define MAX_SCAN_ERROR 29
+#define MAX_SCAN_ERROR 32
 
 #endif
 

data/samples/flashfinder

@@ -0,0 +1,70 @@
+#!/usr/bin/env ruby
+# Simple yara-ruby script to extract SWF files from raw blobs
+#
+#    yara-ruby - Ruby bindings for the yara malware analysis library.
+#    Eric Monti
+#    Copyright (C) 2011 Trustwave Holdings
+#
+#    This program is free software: you can redistribute it and/or modify it 
+#    under the terms of the GNU General Public License as published by the 
+#    Free Software Foundation, either version 3 of the License, or (at your
+#    option) any later version.
+#
+#    This program is distributed in the hope that it will be useful, but 
+#    WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+#    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+#    for more details.
+#
+#    You should have received a copy of the GNU General Public License along
+#    with this program. If not, see <http://www.gnu.org/licenses/>.
+#
+$: << File.join(File.dirname(__FILE__), '..', 'lib')
+require 'yara'
+require 'pp'
+
+ctx = Yara::Rules.new
+ctx.compile_string <<_EOF_
+rule fws 
+{
+  meta:
+    desc = "SWF file"
+    ext = "swf"
+  strings: $a = { 46 57 53 }
+  condition: $a
+}
+
+rule cws 
+{
+  meta:
+    desc = "Compressed SWF file"
+    ext = "swf"
+  strings: $a = { 43 57 53 }
+  condition: $a
+}
+
+_EOF_
+
+
+ARGV.each do |fname|
+  begin
+    file = File.new(fname, 'rb')
+    ctx.scan_file(fname).each do |match|
+      match.strings.each do |string|
+        file.pos = string.offset
+        hdr = file.read(8)
+
+        magic, vers, len = hdr.unpack("A3CV")
+
+        outf = "#{fname}_%0.8x.#{match.meta['ext']}" % string.offset
+        STDERR.puts "Found #{match.meta['desc']} version #{vers} in #{fname.inspect} @0x#{string.offset.to_s(16)} - writing to #{outf.inspect}"
+
+        File.open(outf, 'wb') do |out|
+          out.write hdr 
+          out.write file.read(len-8)
+        end
+      end
+    end
+  ensure
+    file.close if file
+  end
+end

metadata

@@ -4,9 +4,9 @@ version: !ruby/object:Gem::Version
   prerelease: false
   segments: 
   - 1
-  - 5
+  - 6
   - 0
-  version: 1.5.0
+  version: 1.6.0
 platform: ruby
 authors: 
 - Eric Monti
@@ -14,13 +14,13 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2011-04-18 00:00:00 -05:00
+date: 2011-08-26 00:00:00 -05:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
   name: rspec
+  prerelease: false
   requirement: &id001 !ruby/object:Gem::Requirement 
-    none: false
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
@@ -30,12 +30,11 @@ dependencies:
         - 0
         version: 2.3.0
   type: :development
-  prerelease: false
   version_requirements: *id001
 - !ruby/object:Gem::Dependency 
   name: yard
+  prerelease: false
   requirement: &id002 !ruby/object:Gem::Requirement 
-    none: false
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
@@ -45,12 +44,11 @@ dependencies:
         - 0
         version: 0.6.0
   type: :development
-  prerelease: false
   version_requirements: *id002
 - !ruby/object:Gem::Dependency 
   name: bundler
+  prerelease: false
   requirement: &id003 !ruby/object:Gem::Requirement 
-    none: false
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
@@ -60,12 +58,11 @@ dependencies:
         - 0
         version: 1.0.0
   type: :development
-  prerelease: false
   version_requirements: *id003
 - !ruby/object:Gem::Dependency 
   name: jeweler
+  prerelease: false
   requirement: &id004 !ruby/object:Gem::Requirement 
-    none: false
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
@@ -75,12 +72,11 @@ dependencies:
         - 2
         version: 1.5.2
   type: :development
-  prerelease: false
   version_requirements: *id004
 - !ruby/object:Gem::Dependency 
   name: rcov
+  prerelease: false
   requirement: &id005 !ruby/object:Gem::Requirement 
-    none: false
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
@@ -88,12 +84,11 @@ dependencies:
         - 0
         version: "0"
   type: :development
-  prerelease: false
   version_requirements: *id005
 - !ruby/object:Gem::Dependency 
   name: rake-compiler
+  prerelease: false
   requirement: &id006 !ruby/object:Gem::Requirement 
-    none: false
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
@@ -101,7 +96,6 @@ dependencies:
         - 0
         version: "0"
   type: :development
-  prerelease: false
   version_requirements: *id006
 description: Ruby bindings for the yara malware analysis library
 email: emonti@trustwave.com
@@ -132,6 +126,7 @@ files:
 - ext/yara_native/Yara_native.h
 - ext/yara_native/extconf.rb
 - lib/yara.rb
+- samples/flashfinder
 - samples/ispe.rb
 - samples/sslkeyfinder
 - samples/upx.rb
@@ -151,16 +146,13 @@ rdoc_options: []
 require_paths: 
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement 
-  none: false
   requirements: 
   - - ">="
     - !ruby/object:Gem::Version 
-      hash: -9224945978915744
       segments: 
       - 0
       version: "0"
 required_rubygems_version: !ruby/object:Gem::Requirement 
-  none: false
   requirements: 
   - - ">="
     - !ruby/object:Gem::Version 
@@ -170,7 +162,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 
 rubyforge_project: 
-rubygems_version: 1.3.7
+rubygems_version: 1.3.6
 signing_key: 
 specification_version: 3
 summary: Ruby bindings for libyara