binsec 3.0.0

Swiss Army Knife for Binary (In)Security
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107

//! YARA rules to apply against all binary formats. We use this rather than parsing through the
//! executable format through libgoblin to cut out implementing repetition for each format.

pub const INSTRUMENTATION_RULES: &str = r#"
    rule afl {
        meta:
            name = "AFL Instrumentation"
        strings:
            $afl = /__afl\w+\d+/
        condition:
            any of them
    }

    rule asan {
        meta:
            name = "Address Sanitizer (ASan)"
        strings:
            $asan = /_ZN\w+__asan\w+\d+/
        condition:
            any of them
    }

    rule ubsan {
        meta:
            name = "Undefined Behavior Sanitizer (UBsan)"
        strings:
            $ubsan = /__ubsan\w+\d+/
        condition:
            any of them
    }

    rule llvm {
        meta:
            name = "LLVM Code Coverage"
        strings:
            $llvm = /__llvm\w+\d+/
        condition:
            any of them
    }
"#;

pub const UNIVERSAL_COMPILER_RULES: &str = r#"
    rule rust {
        meta:
            name = "rustc"
        strings:
            $mangled = /_ZN\w+rustc_demangle\w+\d+/
        condition:
            any of them
    }

    rule golang {
        meta:
            name = "go"
        strings:
            $a = "runtime.decoderune"
            $b = "golang"
        condition:
            $a or $b
    }

    rule pyinstaller {
        meta:
            name = "Python / PyInstaller"
        strings:
            $pyi = "pyi_bootstrap"
        condition:
            $pyi
    }
"#;

pub const ELF_COMPILER_RULES: &str = r#"
    rule gcc {
        meta:
            name = "GCC C/C++"
        strings:
            $a = "GCC: ("
        condition:
            any of them
    }
"#;

pub const PE_COMPILER_RULES: &str = r#"
    // TODO: test out

    rule msvc {
        meta:
            name = "MSVC C/C++"
        strings:
            $0 = "MSVCRT"
            $1 = "MSVCR90"
            $2 = "MSVCR80"
            $3 = "MSVCR71"
            $4 = "MSVCR70"
        condition:
            any of them
    }

    rule dotnet {
        meta:
            name = "Dotnet"
        strings:
            $0 = "mscor"
        condition:
            any of them
    }
"#;