feat: memory module

BUILD.bazel

@@ -80,6 +80,7 @@ yara_library(
         "time",
         "console",
         "string",
+        "memory",
     ],
     modules_srcs = [
         "libyara/modules/cuckoo/cuckoo.c",
@@ -96,6 +97,7 @@ yara_library(
         "libyara/modules/time/time.c",
         "libyara/modules/console/console.c",
         "libyara/modules/string/string.c",
+        "libyara/modules/memory/memory.c",
     ],
     deps = [
         "@jansson",

Makefile.am

@@ -140,6 +140,7 @@ endif
 #
 # MODULES += libyara/modules/yourmodule.c
 #
+MODULES += libyara/modules/memory/memory.c
 
 include_HEADERS = libyara/include/yara.h
 

libyara/include/yara/proc.h

@@ -55,4 +55,68 @@ YR_API YR_MEMORY_BLOCK* yr_process_get_next_memory_block(
 YR_API const uint8_t* yr_process_fetch_memory_block_data(
     YR_MEMORY_BLOCK* block);
 
+
+#if defined(USE_WINDOWS_PROC)
+
+#include <windows.h>
+
+typedef struct _YR_PROC_INFO
+{
+  HANDLE hProcess;
+  SYSTEM_INFO si;
+} YR_PROC_INFO;
+#elif defined(USE_LINUX_PROC)
+
+#include <unistd.h>
+
+typedef struct _YR_PROC_INFO
+{
+  int pid;
+  int mem_fd;
+  int pagemap_fd;
+  FILE* maps;
+  uint64_t map_offset;
+  uint64_t next_block_end;
+  int page_size;
+  char map_path[PATH_MAX];
+  uint64_t map_dmaj;
+  uint64_t map_dmin;
+  uint64_t map_ino;
+} YR_PROC_INFO;
+
+#elif defined(USE_MACH_PROC)
+
+#include <mach/mach.h>
+
+typedef struct _YR_PROC_INFO
+{
+  task_t task;
+} YR_PROC_INFO;
+
+#elif defined(USE_OPENBSD_PROC)
+
+#include <sys/types.h>
+#include <sys/ptrace.h>
+#include <sys/sysctl.h>
+#include <sys/wait.h>
+
+typedef struct _YR_PROC_INFO
+{
+  int pid;
+  uint64_t old_end;
+  struct kinfo_vmentry vm_entry;
+} YR_PROC_INFO;
+
+#elif defined(USE_FREEBSD_PROC)
+
+#include <sys/ptrace.h>
+
+typedef struct _YR_PROC_INFO
+{
+  int pid;
+  struct ptrace_vm_entry vm_entry;
+} YR_PROC_INFO;
+
+#endif
+
 #endif

libyara/modules/memory/memory.c

@@ -0,0 +1,97 @@
+/*
+Copyright (c) 2023. The YARA Authors. All Rights Reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+this list of conditions and the following disclaimer in the documentation and/or
+other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its contributors
+may be used to endorse or promote products derived from this software without
+specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#include <stdlib.h>
+#include <errno.h>
+
+#include <yara/modules.h>
+#include <yara/proc.h>
+#include <yara/utils.h>
+
+#define MODULE_NAME memory
+
+#include "memory.h"
+
+#if defined(USE_LINUX_PROC)
+#include "memory_linux.c"
+#elif defined(USE_WINDOWS_PROC)
+#include "memory_windows.c"
+#elif defined(USE_MACH_PROC)
+#include "memory_mach.c"
+#elif defined(USE_OPENBSD_PROC)
+#include "memory_openbsd.c"
+#elif defined(USE_FREEBSD_PROC)
+#include "memory_freebsd.c"
+#else
+#include "memory_others.c"
+#endif
+
+begin_declarations
+  declare_integer("PAGE_SIZE");
+  declare_integer("EXECUTE");
+  declare_integer("WRITE");
+  declare_integer("READ");
+  declare_function("protection", "i", "i", protection);
+end_declarations
+
+int module_initialize(YR_MODULE* module)
+{
+  page_size = get_page_size();
+  return ERROR_SUCCESS;
+}
+
+int module_finalize(YR_MODULE* module)
+{
+  return ERROR_SUCCESS;
+}
+
+int module_load(
+    YR_SCAN_CONTEXT* context,
+    YR_OBJECT* module_object,
+    void* module_data,
+    size_t module_data_size)
+{
+  if (context->flags & SCAN_FLAGS_PROCESS_MEMORY)
+  {
+    YR_PROC_ITERATOR_CTX* proc_context = (YR_PROC_ITERATOR_CTX*) context->iterator->context;
+    module_object->data = proc_context->proc_info;
+  }
+
+  yr_set_integer(page_size, module_object, "PAGE_SIZE");
+  yr_set_integer(EXECUTE, module_object, "EXECUTE");
+  yr_set_integer(WRITE, module_object, "WRITE");
+  yr_set_integer(READ, module_object, "READ");
+
+  return ERROR_SUCCESS;
+}
+
+int module_unload(YR_OBJECT* module_object)
+{
+  return ERROR_SUCCESS;
+}

libyara/modules/memory/memory.h

@@ -0,0 +1,39 @@
+/*
+Copyright (c) 2023. The YARA Authors. All Rights Reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+this list of conditions and the following disclaimer in the documentation and/or
+other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its contributors
+may be used to endorse or promote products derived from this software without
+specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#ifndef YR_MEMORY_H
+#define YR_MEMORY_H
+
+static int page_size = -1;
+
+#define EXECUTE 1
+#define WRITE 2
+#define READ 4
+
+#endif

libyara/modules/memory/memory_freebsd.c

@@ -0,0 +1,94 @@
+/*
+Copyright (c) 2023. The YARA Authors. All Rights Reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+this list of conditions and the following disclaimer in the documentation and/or
+other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its contributors
+may be used to endorse or promote products derived from this software without
+specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#include <sys/types.h>
+#include <sys/ptrace.h>
+#include <sys/sysctl.h>
+#include <sys/wait.h>
+
+#include <yara/modules.h>
+#include <yara/proc.h>
+#include <yara/utils.h>
+
+#include "memory.h"
+
+define_function(protection)
+{
+  YR_OBJECT* module = yr_module();
+  if (module->data == NULL)
+  {
+    return_integer(YR_UNDEFINED);
+  }
+  int64_t address = integer_argument(1);
+
+  if (address == YR_UNDEFINED)
+  {
+    return_integer(YR_UNDEFINED);
+  }
+
+  YR_PROC_INFO* proc_info = (YR_PROC_INFO*) module->data;  
+
+  struct ptrace_vm_entry vm_entry;
+  memset(&vm_entry, 0, sizeof(struct ptrace_vm_entry));
+
+  while (vm_entry.pve_end <= address)
+  {
+    if (ptrace(
+            PT_VM_ENTRY, proc_info->pid, (char*) (&vm_entry), 0) ==
+        -1)
+    {
+      return_integer(YR_UNDEFINED);
+    }
+  }
+
+  if (vm_entry.pve_start > address || vm_entry.pve_end <= address)
+  {
+      return_integer(YR_UNDEFINED);
+  }
+
+  int protection = 0;
+  if (vm_entry.pve_prot & 1)
+  {
+    protection |= READ;
+  }
+  if (vm_entry.pve_prot & 2)
+  {
+    protection |= WRITE;
+  }
+  if (vm_entry.pve_prot & 4)
+  {
+    protection |= EXECUTE;
+  }
+  return_integer(protection);
+}
+
+int get_page_size()
+{
+  return PAGE_SIZE;
+}