mace 0.1.4

Automated extration of malware configuration, focusing on C2 communication
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

use anyhow::Result;
use exe::VecPE;
use iced_x86::{Code, Decoder, DecoderOptions};
use yara_x::{Compiler, Scanner};

use crate::{extractor::dmsniff::rules::RULE_PREFIX, utils::get_bitness_from_pe};

pub fn extract_prefix_from_dga_function(pe: &VecPE, function_data: &[u8]) -> Result<String> {
    let mut res = String::new();

    // compile rule and get scan results
    let mut compiler = Compiler::new();
    compiler.add_source(RULE_PREFIX)?;

    let rules = compiler.build();
    let mut scanner = Scanner::new(&rules);
    let results = scanner.scan(function_data)?;

    let bitness = get_bitness_from_pe(pe);

    for rule in results.matching_rules() {
        for pattern in rule.patterns() {
            for mat in pattern.matches() {
                let decoder = Decoder::new(bitness, mat.data(), DecoderOptions::NONE);

                // get prefix characters that are moved onto the stack
                for instruction in decoder {
                    if !matches!(instruction.code(), Code::Mov_rm8_imm8) {
                        return Ok(res);
                    }

                    let immediate = instruction.immediate8();
                    if immediate != 0 {
                        res.push(immediate.into());
                    }
                }
            }
        }
    }

    Ok(res)
}