yara-x 0.11.0__tar.gz → 0.11.1__tar.gz

{yara_x-0.11.0 → yara_x-0.11.1}/Cargo.lock

@@ -2981,9 +2981,9 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.210"
+version = "1.0.215"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8e3592472072e6e22e0a54d5904d9febf8508f65fb8552499a1abc7d1078c3a"
+checksum = "6513c1ad0b11a9376da888e3e0baa0077f1aed55c17f50e7b2397136129fb88f"
 dependencies = [
  "serde_derive",
 ]
@@ -3001,9 +3001,9 @@ dependencies = [
 
 [[package]]
 name = "serde_derive"
-version = "1.0.210"
+version = "1.0.215"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "243902eda00fad750862fc144cea25caca5e20d615af0a81bee94ca738f1df1f"
+checksum = "ad1e866f866923f252f05c889987993144fb74e722403468a4ebd70c3cd756c0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4358,7 +4358,7 @@ checksum = "cfe53a6657fd280eaa890a3bc59152892ffa3e30101319d168b781ed6529b049"
 
 [[package]]
 name = "yara-x"
-version = "0.11.0"
+version = "0.11.1"
 dependencies = [
  "aho-corasick",
  "annotate-snippets",
@@ -4429,7 +4429,7 @@ dependencies = [
 
 [[package]]
 name = "yara-x-capi"
-version = "0.11.0"
+version = "0.11.1"
 dependencies = [
  "cbindgen",
  "serde_json",
@@ -4438,7 +4438,7 @@ dependencies = [
 
 [[package]]
 name = "yara-x-cli"
-version = "0.11.0"
+version = "0.11.1"
 dependencies = [
  "anyhow",
  "ascii_tree",
@@ -4472,7 +4472,7 @@ dependencies = [
 
 [[package]]
 name = "yara-x-fmt"
-version = "0.11.0"
+version = "0.11.1"
 dependencies = [
  "bitmask",
  "bstr",
@@ -4487,7 +4487,7 @@ dependencies = [
 
 [[package]]
 name = "yara-x-macros"
-version = "0.11.0"
+version = "0.11.1"
 dependencies = [
  "darling",
  "proc-macro2",
@@ -4497,7 +4497,7 @@ dependencies = [
 
 [[package]]
 name = "yara-x-parser"
-version = "0.11.0"
+version = "0.11.1"
 dependencies = [
  "anyhow",
  "ascii_tree",
@@ -4521,7 +4521,7 @@ dependencies = [
 
 [[package]]
 name = "yara-x-proto"
-version = "0.11.0"
+version = "0.11.1"
 dependencies = [
  "protobuf",
  "protobuf-codegen",
@@ -4530,7 +4530,7 @@ dependencies = [
 
 [[package]]
 name = "yara-x-proto-yaml"
-version = "0.11.0"
+version = "0.11.1"
 dependencies = [
  "chrono",
  "globwalk",
@@ -4545,7 +4545,7 @@ dependencies = [
 
 [[package]]
 name = "yara-x-py"
-version = "0.11.0"
+version = "0.11.1"
 dependencies = [
  "protobuf-json-mapping",
  "pyo3",

{yara_x-0.11.0 → yara_x-0.11.1}/Cargo.toml

@@ -1,5 +1,5 @@
 [workspace.package]
-version = "0.11.0"
+version = "0.11.1"
 authors = ["Victor M. Alvarez <vmalvarez@virustotal.com>"]
 edition = "2021"
 homepage = "https://virustotal.github.io/yara-x"
@@ -79,8 +79,8 @@ regex-automata = "0.4.7"
 roxmltree = "0.20.0"
 rsa = "0.9.6"
 rustc-hash = "2.0.0"
-serde = "=1.0.210"
-serde_json = "1.0.132"
+serde = "1.0.215"
+serde_json = "1.0.133"
 sha1 = "0.10.6"
 sha2 = "0.10.8"
 smallvec = "1.13.2"
@@ -95,11 +95,11 @@ x509-parser = "0.16.0"
 yaml-rust = "0.4.5"
 yansi = "1.0.1"
 yara-x = { path = "lib" }
-yara-x-fmt = { path = "fmt", version = "0.11.0" }
-yara-x-macros = { path = "macros", version = "0.11.0" }
-yara-x-parser = { path = "parser", version = "0.11.0" }
-yara-x-proto = { path = "proto", version = "0.11.0" }
-yara-x-proto-yaml = { path = "proto-yaml", version = "0.11.0" }
+yara-x-fmt = { path = "fmt", version = "0.11.1" }
+yara-x-macros = { path = "macros", version = "0.11.1" }
+yara-x-parser = { path = "parser", version = "0.11.1" }
+yara-x-proto = { path = "proto", version = "0.11.1" }
+yara-x-proto-yaml = { path = "proto-yaml", version = "0.11.1" }
 zip = "2.1.1"
 
 # Special profile that builds a release binary with link-time optimization.

{yara_x-0.11.0 → yara_x-0.11.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: yara-x
-Version: 0.11.0
+Version: 0.11.1
 Classifier: Programming Language :: Rust
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Python :: Implementation :: PyPy
@@ -9,7 +9,7 @@ Summary: Python bindings for YARA-X
 Keywords: pattern-matching,cybersecurity,forensics,malware,yara
 Home-Page: https://virustotal.github.io/yara-x
 License: BSD-3-Clause
-Requires-Python: >=3.8
+Requires-Python: >=3.9
 Description-Content-Type: text/markdown; charset=UTF-8; variant=GFM
 Project-URL: homepage, https://virustotal.github.io/yara-x
 Project-URL: repository, https://github.com/VirusTotal/yara-x.git

yara_x-0.11.1/lib/src/modules/cuckoo/mod.rs

@@ -0,0 +1,249 @@
+#[cfg(feature = "logging")]
+use log::error;
+
+use crate::compiler::RegexpId;
+use crate::modules::prelude::*;
+use crate::modules::protos::cuckoo::*;
+
+mod schema;
+#[cfg(test)]
+mod tests;
+
+use std::cell::RefCell;
+use std::rc::Rc;
+thread_local! {
+    static LOCAL_DATA: RefCell<Option<Rc<schema::CuckooJson>>> = const { RefCell::new(None) };
+}
+
+fn get_local() -> Option<Rc<schema::CuckooJson>> {
+    LOCAL_DATA.with(|data| data.borrow().clone())
+}
+
+fn set_local(value: schema::CuckooJson) {
+    LOCAL_DATA.with(|data| {
+        *data.borrow_mut() = Some(Rc::new(value));
+    });
+}
+
+#[module_main]
+fn main(_data: &[u8], meta: Option<&[u8]>) -> Cuckoo {
+    let parsed =
+        serde_json::from_slice::<schema::CuckooJson>(meta.unwrap_or_default());
+
+    match parsed {
+        Ok(parsed) => {
+            set_local(parsed);
+        }
+        #[cfg(feature = "logging")]
+        Err(e) => {
+            error!("can't parse cuckoo report: {}", e);
+        }
+        #[cfg(not(feature = "logging"))]
+        Err(_) => {}
+    };
+
+    Cuckoo::new()
+}
+
+#[module_export(name = "network.dns_lookup")]
+fn network_dns_lookup_r(
+    ctx: &ScanContext,
+    regexp_id: RegexpId,
+) -> Option<i64> {
+    Some(
+        get_local()?
+            .network
+            .domains
+            .iter()
+            .flatten()
+            .filter(|domain| {
+                ctx.regexp_matches(regexp_id, domain.domain.as_bytes())
+            })
+            .count() as _,
+    )
+}
+
+#[module_export(name = "network.http_request")]
+fn network_http_request_r(
+    ctx: &ScanContext,
+    regexp_id: RegexpId,
+) -> Option<i64> {
+    Some(
+        get_local()?
+            .network
+            .http
+            .iter()
+            .flatten()
+            .filter(|http| {
+                http.method.is_some() // ~> is request (is not response)
+                    && ctx.regexp_matches(regexp_id, http.uri.as_bytes())
+            })
+            .count() as _,
+    )
+}
+
+#[module_export(name = "network.http_get")]
+fn network_http_get_r(ctx: &ScanContext, regexp_id: RegexpId) -> Option<i64> {
+    Some(
+        get_local()?
+            .network
+            .http
+            .iter()
+            .flatten()
+            .filter(|http| {
+                http.method
+                    .as_ref()
+                    .map(|method| method.eq_ignore_ascii_case("get"))
+                    .unwrap_or(false)
+                    && ctx.regexp_matches(regexp_id, http.uri.as_bytes())
+            })
+            .count() as _,
+    )
+}
+
+#[module_export(name = "network.http_post")]
+fn network_http_post_r(ctx: &ScanContext, regexp_id: RegexpId) -> Option<i64> {
+    Some(
+        get_local()?
+            .network
+            .http
+            .iter()
+            .flatten()
+            .filter(|http| {
+                http.method
+                    .as_ref()
+                    .map(|method| method.eq_ignore_ascii_case("post"))
+                    .unwrap_or(false)
+                    && ctx.regexp_matches(regexp_id, http.uri.as_bytes())
+            })
+            .count() as _,
+    )
+}
+
+#[module_export(name = "network.http_user_agent")]
+fn network_http_user_agent_r(
+    ctx: &ScanContext,
+    regexp_id: RegexpId,
+) -> Option<i64> {
+    Some(
+        get_local()?
+            .network
+            .http
+            .iter()
+            .flatten()
+            .flat_map(|http| http.user_agent.iter())
+            .filter(|user_agent| {
+                ctx.regexp_matches(regexp_id, user_agent.as_bytes())
+            })
+            .count() as _,
+    )
+}
+
+#[module_export(name = "network.tcp")]
+fn network_tcp_ri(
+    ctx: &ScanContext,
+    dst_re: RegexpId,
+    port: i64,
+) -> Option<i64> {
+    Some(
+        get_local()?
+            .network
+            .tcp
+            .iter()
+            .flatten()
+            .filter(|tcp| {
+                tcp.dport == port as u64
+                    && tcp
+                        .dst
+                        .iter()
+                        .chain(tcp.dst_domain.iter())
+                        .any(|dst| ctx.regexp_matches(dst_re, dst.as_bytes()))
+            })
+            .count() as _,
+    )
+}
+
+#[module_export(name = "network.udp")]
+fn network_udp_ri(
+    ctx: &ScanContext,
+    dst_re: RegexpId,
+    port: i64,
+) -> Option<i64> {
+    Some(
+        get_local()?
+            .network
+            .udp
+            .iter()
+            .flatten()
+            .filter(|udp| {
+                udp.dport == port as u64
+                    && udp
+                        .dst
+                        .iter()
+                        .chain(udp.dst_domain.iter())
+                        .any(|dst| ctx.regexp_matches(dst_re, dst.as_bytes()))
+            })
+            .count() as _,
+    )
+}
+
+#[module_export(name = "network.host")]
+fn network_host_r(ctx: &ScanContext, re: RegexpId) -> Option<i64> {
+    Some(
+        get_local()?
+            .network
+            .hosts
+            .iter()
+            .flatten()
+            .filter(|host| ctx.regexp_matches(re, host.as_bytes()))
+            .count() as _,
+    )
+}
+
+#[module_export(name = "sync.mutex")]
+fn sync_mutex_r(ctx: &ScanContext, mutex_re: RegexpId) -> Option<i64> {
+    Some(
+        get_local()?
+            .behavior
+            .summary
+            .mutexes
+            .iter()
+            .flatten()
+            .filter(|mutex| ctx.regexp_matches(mutex_re, mutex.as_bytes()))
+            .count() as _,
+    )
+}
+
+#[module_export(name = "filesystem.file_access")]
+fn filesystem_file_access_r(
+    ctx: &ScanContext,
+    regexp_id: RegexpId,
+) -> Option<i64> {
+    Some(
+        get_local()?
+            .behavior
+            .summary
+            .files
+            .iter()
+            .flatten()
+            .filter(|file| ctx.regexp_matches(regexp_id, file.as_bytes()))
+            .count() as _,
+    )
+}
+
+#[module_export(name = "registry.key_access")]
+fn registry_key_access_r(
+    ctx: &ScanContext,
+    regexp_id: RegexpId,
+) -> Option<i64> {
+    Some(
+        get_local()?
+            .behavior
+            .summary
+            .keys
+            .iter()
+            .flatten()
+            .filter(|key| ctx.regexp_matches(regexp_id, key.as_bytes()))
+            .count() as _,
+    )
+}

yara_x-0.11.1/lib/src/modules/cuckoo/schema.rs

@@ -0,0 +1,166 @@
+use std::fmt;
+
+use serde::de::Error;
+use serde::{de::Visitor, Deserialize, Deserializer};
+
+#[derive(serde::Deserialize, Debug)]
+pub(super) struct DomainJson {
+    pub domain: String,
+}
+
+#[derive(serde::Deserialize, Debug)]
+pub(super) struct HttpJson {
+    #[serde(rename = "user-agent")]
+    pub user_agent: Option<String>,
+    pub method: Option<String>, // string ftw
+    pub uri: String,
+}
+
+#[derive(serde::Deserialize, Debug)]
+pub(super) struct TcpJson {
+    pub dst: Option<String>,
+    pub dst_domain: Option<String>,
+    pub dport: u64,
+}
+
+#[derive(serde::Deserialize, Debug)]
+pub(super) struct UdpJson {
+    pub dst: Option<String>,
+    pub dst_domain: Option<String>,
+    pub dport: u64,
+}
+
+#[derive(/* serde::Deserialize, - custom */ Debug)]
+pub(super) struct NetworkJson {
+    pub domains: Option<Vec<DomainJson>>,
+    pub http: Option<Vec<HttpJson>>,
+    pub tcp: Option<Vec<TcpJson>>,
+    pub udp: Option<Vec<UdpJson>>,
+    pub hosts: Option<Vec<String>>,
+}
+
+#[derive(serde::Deserialize, Debug)]
+pub(super) struct SummaryJson {
+    pub mutexes: Option<Vec<String>>,
+    pub files: Option<Vec<String>>,
+    pub keys: Option<Vec<String>>,
+}
+
+#[derive(serde::Deserialize, Debug)]
+pub(super) struct BehaviorJson {
+    pub summary: SummaryJson,
+}
+
+#[derive(serde::Deserialize, Debug)]
+pub(super) struct CuckooJson {
+    pub network: NetworkJson,
+    pub behavior: BehaviorJson,
+}
+
+impl<'de> Deserialize<'de> for NetworkJson {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        struct MyVisitor;
+
+        impl<'de> Visitor<'de> for MyVisitor {
+            type Value = NetworkJson;
+
+            fn expecting(&self, fmt: &mut fmt::Formatter<'_>) -> fmt::Result {
+                fmt.write_str("string or object")
+            }
+
+            fn visit_map<A>(self, mut map: A) -> Result<Self::Value, A::Error>
+            where
+                A: serde::de::MapAccess<'de>,
+            {
+                // Must not parse `old_domains` before the whole map is
+                // searched if there is a `domains` field, then the value for
+                // the key `old_domains` should be ignored - specifically, it
+                // is okay if the `old_domains` does not have the expected
+                // structure if `domains` is present.
+                let mut old_domains = None::<serde_json::Value>;
+                let mut domains = None::<serde_json::Value>;
+
+                let mut http = None::<Vec<HttpJson>>;
+                let mut tcp = None::<Vec<TcpJson>>;
+                let mut udp = None::<Vec<UdpJson>>;
+                let mut hosts = None::<Vec<String>>;
+
+                while let Some((key, val)) =
+                    map.next_entry::<String, serde_json::Value>()?
+                {
+                    match key.as_str() {
+                        "domains" => {
+                            domains = Some(val);
+                        }
+                        "dns" => {
+                            if domains.is_some() {
+                                continue; // prefer "domains" over "dns"
+                            }
+                            old_domains = Some(val);
+                        }
+                        "http" => {
+                            http = Some(
+                                Deserialize::deserialize(val)
+                                    .map_err(Error::custom)?,
+                            );
+                        }
+                        "tcp" => {
+                            tcp = Some(
+                                Deserialize::deserialize(val)
+                                    .map_err(Error::custom)?,
+                            );
+                        }
+                        "udp" => {
+                            udp = Some(
+                                Deserialize::deserialize(val)
+                                    .map_err(Error::custom)?,
+                            );
+                        }
+                        "hosts" => {
+                            hosts = Some(
+                                Deserialize::deserialize(val)
+                                    .map_err(Error::custom)?,
+                            );
+                        }
+                        _ => {}
+                    }
+                }
+
+                #[derive(serde::Deserialize, Debug)]
+                struct OldDomainJson {
+                    pub hostname: String,
+                }
+
+                let domains: Option<Vec<DomainJson>> =
+                    match (domains, old_domains) {
+                        (Some(domains), _) => {
+                            Deserialize::deserialize(domains)
+                                .map_err(Error::custom)?
+                        }
+                        (None, Some(old_domains)) => {
+                            let old_domains: Vec<OldDomainJson> =
+                                Deserialize::deserialize(old_domains)
+                                    .map_err(Error::custom)?;
+
+                            Some(
+                                old_domains
+                                    .into_iter()
+                                    .map(|old| DomainJson {
+                                        domain: old.hostname,
+                                    })
+                                    .collect(),
+                            )
+                        }
+                        (None, None) => None, // domains field is optional
+                    };
+
+                Ok(NetworkJson { domains, http, tcp, udp, hosts })
+            }
+        }
+
+        deserializer.deserialize_any(MyVisitor)
+    }
+}

{yara_x-0.11.0 → yara_x-0.11.1}/lib/src/modules/pe/parser.rs

@@ -1752,9 +1752,9 @@ impl<'a> PE<'a> {
     /// arrays equivalent to the INT and IAT.
     ///
     /// Another differences between ordinal and delayed imports is that in
-    /// in delayed imports the INT and IAT can contain virtual addresses
-    /// instead of relative virtual address (RVAs). Whether they contain one
-    /// or the other depends on a bit in the `attributes` field in the
+    /// delayed imports the INT and IAT can contain virtual addresses instead
+    /// of relative virtual address (RVAs). Whether they contain one or the
+    /// other depends on a bit in the `attributes` field in the
     /// IMAGE_DELAYLOAD_DESCRIPTOR structure.
     fn parse_import_impl<P>(
         &self,
@@ -1789,6 +1789,8 @@ impl<'a> PE<'a> {
             }),
         );
 
+        let mut num_imported_funcs = 0;
+
         for mut descriptor in import_descriptors.take(Self::MAX_PE_IMPORTS) {
             // If the values in the descriptor are virtual addresses, convert
             // them to relative virtual addresses (RVAs) by subtracting the
@@ -1900,10 +1902,11 @@ impl<'a> PE<'a> {
             }
 
             if !funcs.is_empty() {
+                num_imported_funcs += funcs.len();
                 imported_funcs.push((dll_name, funcs));
             }
 
-            if imported_funcs.len() >= Self::MAX_PE_IMPORTS {
+            if num_imported_funcs >= Self::MAX_PE_IMPORTS {
                 break;
             }
         }

{yara_x-0.11.0 → yara_x-0.11.1}/pyproject.toml

@@ -1,11 +1,11 @@
 [build-system]
-requires = ["maturin>=1.0,<2.0"]
+requires = ["maturin==1.7.4"]
 build-backend = "maturin"
 
 [project]
 name = "yara-x"
 description = "Python bindings for YARA-X"
-requires-python = ">=3.8"
+requires-python = ">=3.9"
 readme = "README.md"
 keywords = ["pattern-matching", "cybersecurity", "forensics", "malware", "yara"]
 classifiers = [