williballenthin

rule get_eip
{
    meta:
        author = "William Ballenthin"
        email = "[email protected]"
        license = "Apache 2.0"
        copyright = "FireEye, Inc"
        description = "Match x86 that appears to fetch $PC."

    strings:

williballenthin

manual import resolution

example from 0f5d5d07c6533bc6d991836ce79daaa1:

_0:00F20012 33 D2                   xor     edx, edx
_0:00F20014 64 8B 52 30             mov     edx, fs:[edx+30h] // TEB->PEB
_0:00F20018 8B 52 0C                mov     edx, [edx+0Ch]    // PEB->LDR_DATA
_0:00F2001B 8B 52 14                mov     edx, [edx+14h]    // LDR_DATA->InMemoryOrderLinks (_LDR_DATA_TABLE_ENTRY)
                                                              // alt: 0xC: InLoadOrderLinks
 // alt: 0x1C: InInitializationOrderLinks

williballenthin

#!/usr/bin/env python3
'''
A simplified FLOSS implementation that only supports stackstrings.

requirements:
  - yara-python
  - unicorn

author: Willi Ballenthin
email: [email protected]

williballenthin

williballenthin

references:

• https://reverseengineering.stackexchange.com/questions/1597/reverse-engineering-a-visual-basic-p-code-binary
• http://web.archive.org/web/20071020232030/http://www.alex-ionescu.com/vb.pdf (ref: Alex Ionescu)
• http://web.archive.org/web/20101127044116/http://vb-decompiler.com/pcode/opcodes.php?t=1
• https://github.com/bontchev/pcodedmp
• http://www.openrce.org/blog/view/1719/Visual_Basic_6_IDC_updated
• https://pediy.com/thread-12832.htm
• https://github.com/vic4key/VB-Exe-Parser/blob/master/VB-Parser.py
• http://www.openrce.org/repositories/users/Paolo/vbpython.py

williballenthin

williballenthin

williballenthin

import os
import sys
import logging

import pefile
import ucutils
import unicorn
import capstone
import argparse

williballenthin

rule stack_strings
{
    meta:
        author = "William Ballenthin"
        email = "[email protected]"
        license = "Apache 2.0"
        copyright = "FireEye, Inc"
        description = "Match x86 that appears to be stack string creation."

    strings:

williballenthin

#!/usr/bin/env python2
'''
search for YARA matches in each function within IDA Pro.
upon execution, prompts the user to provide the YARA rules file.

requirements:
  - hexdump
  - yara-python

author: Willi Ballenthin