Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add debug_details and load_config_timestamp to PE module. #1976

Open
wants to merge 4 commits into
base: master
Choose a base branch
from

Conversation

wxsBSD
Copy link
Collaborator

@wxsBSD wxsBSD commented Sep 29, 2023

Debug information is actually stored as an array of debug entries. Historically YARA has only parsed the first available PDB path from this array. However, different debug entries can have different details (including different PDB paths) so I'm choosing to add pe.debug_details array which exposes the type, timestamp and PDB path for each debug entry. I'm careful to maintain the current behavior of parsing the first available PDB path into pe.pdb_path so as to not break existing rules.

Fun fact for the above: I've found at least one MSFT binary that has different PDB paths (System.Data.Entity.ni.pdb
and System.Data.Entity.pdb) in its respective debug entries.

This PR also adds support for LOAD CONFIGURATION parsing. It currently only pulls out the timestamp from there, but can be extended to add more if considered useful. I thought about adding the SEHHandlerCount, and maybe some of the CFG stuff, but decided against it as I'm not sure how useful it will be. The timestamps stored in this area seem to be all over the place in my testing but it may be useful to compare with other timestamps.

I've added a test case for the PDB improvements but haven't found a legit, non-malicious, binary with a timestamp in the LOAD CONFIGURATION structure yet.

Fun fact: debug information is actually an array of structures. Historically,
YARA has stopped parsing after finding the first entry with a PDB path (with
some other restrictions around the type of debug entry this is). However, each
entry can have different information (including pdb paths), so let's add an
array of debug_infos structures which contain timestamp, type and pdb path.

Just in testing I discovered legit binaries that have different PDB paths in
them, which is actually kind of interesting.
Specifically, I'm only parsing out the timestamp field of the structure.

While here, rename the newly created "debug_infos" array to "debug_details".
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant