Yara Undefined values


Author: David Zimmer
Date: 02.25.20 - 10:14am



In the yara pe module, anything that is not explicitly set is initialized with the value UNDEFINED. This causes that section of rule (and or etc) to evaluate to a false in the condition statement, however there is no explicit way to test for the undefined value in itself.

So what if you want to test to see if the rich_signature exists or not?

The only way I have found to do this is to wrap it into its own distinct rule, which then gets properly cast to a boolean that you can then work with.

private rule richHeaderExists 
{
    condition: pe.rich_signature.offset 
}

rule noRichHeader
{
    condition: not richHeaderExists 
}

If you are up for modifying the yara source, you can also add a new function such as the following which I added to pe.c

//declare_function("isdef", "s", "i", isdef); 
//ex: pe.dbg(pe.isdef("rich_signature.offset"))
//    pe.dbg(pe.isdef("number_of_signatures"))
define_function(isdef) 
{
	YR_OBJECT* module = module();
	char* txt = string_argument(1);
	if (yr_object_has_undefined_value(module, txt)){
		return_integer(0);
	}else{
		return_integer(1);
	}
}





Comments: (2)

On 03.27.20 - 11:02pm Dave wrote:
from yara dev plusvic:

Actually, as part of the fix for issue #1180, Im changing the behavior for comparison operators. When some operand is UNDEFINED, the result is false instead of UNDEFINED, so not not (pe.section_index(".symtab") >= 0) will work in YARA 4.0.

For arithmetic and bitwise operations the result is still UNDEFINED if some operand is UNDEFINED

On 11.08.21 - 5:52pm Dave wrote:
This has been addressed formally in issue Added unary operation defined #1529.

More details in the discussion in Is it possible to use UNDEFINED value in "pe" module of YARA? #835.

Solution was a new keyword "defined" example:

condition: defined pe.entry_point

This is not yet in the 4.1.3 release.

 
Leave Comment:
Name:
Email: (not shown)
Message: (Required)
Math Question: 86 + 20 = ? followed by the letter: N 



About Me
More Blogs
Main Site
Posts: (All)
2024 ( 1 )
2023 ( 4 )
2022 ( 5 )
2021 ( 2 )
2020 (5)
     AutoIT versions
     IDA JScript 2
     Using VB6 Obj files from C
     Yara Corrupt Imports
     Yara Undefined values
2019 (6)
     Yara WorkBench
     SafeArrayGetVartype
     vb6 API and call backs
     PrintFile
     ImpAdCallNonVirt
     UConnect Disable Cell Modem
2017 (5)
     IDA python over IPC
     dns wildcard blocking
     64bit IDA Plugins
     anterior lines
     misc news/updates
2016 ( 4 )
2015 ( 5 )
2014 ( 5 )
2013 ( 9 )
2012 ( 13 )
2011 ( 19 )
2010 ( 11 )
2009 ( 1 )