From 4875f28a2d1a44d6ddc860b51a78ad9800a95de7 Mon Sep 17 00:00:00 2001 From: Cyrille Bagard Date: Tue, 12 Sep 2023 22:03:16 +0200 Subject: Count matches from a set of patterns. --- src/analysis/scan/exprs/Makefile.am | 2 + src/analysis/scan/exprs/setcounter-int.h | 62 ++++++ src/analysis/scan/exprs/setcounter.c | 368 +++++++++++++++++++++++++++++++ src/analysis/scan/exprs/setcounter.h | 75 +++++++ src/analysis/scan/grammar.y | 219 +++++++++++++++++- src/analysis/scan/rule.c | 107 ++++++++- src/analysis/scan/rule.h | 3 + src/analysis/scan/tokens.l | 7 + 8 files changed, 835 insertions(+), 8 deletions(-) create mode 100644 src/analysis/scan/exprs/setcounter-int.h create mode 100644 src/analysis/scan/exprs/setcounter.c create mode 100644 src/analysis/scan/exprs/setcounter.h diff --git a/src/analysis/scan/exprs/Makefile.am b/src/analysis/scan/exprs/Makefile.am index d1a122a..a0b2f3d 100644 --- a/src/analysis/scan/exprs/Makefile.am +++ b/src/analysis/scan/exprs/Makefile.am @@ -27,6 +27,8 @@ libanalysisscanexprs_la_SOURCES = \ relational.h relational.c \ set-int.h \ set.h set.c \ + setcounter-int.h \ + setcounter.h setcounter.c \ strop-int.h \ strop.h strop.c diff --git a/src/analysis/scan/exprs/setcounter-int.h b/src/analysis/scan/exprs/setcounter-int.h new file mode 100644 index 0000000..fbed209 --- /dev/null +++ b/src/analysis/scan/exprs/setcounter-int.h @@ -0,0 +1,62 @@ + +/* Chrysalide - Outil d'analyse de fichiers binaires + * setcounter-int.h - prototypes internes pour le décompte global de correspondances locales + * + * Copyright (C) 2023 Cyrille Bagard + * + * This file is part of Chrysalide. + * + * Chrysalide is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * Chrysalide is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Foobar. If not, see . + */ + + +#ifndef _ANALYSIS_SCAN_EXPRS_SETCOUNTER_INT_H +#define _ANALYSIS_SCAN_EXPRS_SETCOUNTER_INT_H + + +#include "setcounter.h" + + +#include "../expr-int.h" + + + +/* Décompte global de correspondances locales (instance) */ +struct _GScanSetMatchCounter +{ + GScanExpression parent; /* A laisser en premier */ + + GSearchPattern **patterns; /* Motifs associés */ + size_t count; /* Nombre de ces motifs */ + + ScanSetCounterType type; /* Type de décompte */ + size_t number; /* Eventuel volume associé */ + +}; + +/* Décompte global de correspondances locales (classe) */ +struct _GScanSetMatchCounterClass +{ + GScanExpressionClass parent; /* A laisser en premier */ + +}; + + + +/* Met en place un décompte de motifs avec correspondances. */ +bool g_scan_set_match_counter_create(GScanSetMatchCounter *, GSearchPattern ** const, size_t); + + + +#endif /* _ANALYSIS_SCAN_EXPRS_SETCOUNTER_INT_H */ diff --git a/src/analysis/scan/exprs/setcounter.c b/src/analysis/scan/exprs/setcounter.c new file mode 100644 index 0000000..14e7676 --- /dev/null +++ b/src/analysis/scan/exprs/setcounter.c @@ -0,0 +1,368 @@ + +/* Chrysalide - Outil d'analyse de fichiers binaires + * setcounter.c - décompte global de correspondances locales + * + * Copyright (C) 2023 Cyrille Bagard + * + * This file is part of Chrysalide. + * + * Chrysalide is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * Chrysalide is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Foobar. If not, see . + */ + + +#include "setcounter.h" + + +#include "setcounter-int.h" +#include "literal.h" + + + +/* --------------------- INSTANCIATION D'UNE FORME DE CONDITION --------------------- */ + + +/* Initialise la classe des opérations booléennes. */ +static void g_scan_set_match_counter_class_init(GScanSetMatchCounterClass *); + +/* Initialise une instance d'opération booléenne. */ +static void g_scan_set_match_counter_init(GScanSetMatchCounter *); + +/* Supprime toutes les références externes. */ +static void g_scan_set_match_counter_dispose(GScanSetMatchCounter *); + +/* Procède à la libération totale de la mémoire. */ +static void g_scan_set_match_counter_finalize(GScanSetMatchCounter *); + + + +/* --------------------- IMPLEMENTATION DES FONCTIONS DE CLASSE --------------------- */ + + +/* Réduit une expression à une forme plus simple. */ +static ScanReductionState g_scan_set_match_counter_reduce(const GScanSetMatchCounter *, GScanContext *, GScanScope *, GScanExpression **); + + + +/* ---------------------------------------------------------------------------------- */ +/* INSTANCIATION D'UNE FORME DE CONDITION */ +/* ---------------------------------------------------------------------------------- */ + + +/* Indique le type défini pour un décompte de résultats lors d'une recherche de motifs. */ +G_DEFINE_TYPE(GScanSetMatchCounter, g_scan_set_match_counter, G_TYPE_SCAN_EXPRESSION); + + +/****************************************************************************** +* * +* Paramètres : klass = classe à initialiser. * +* * +* Description : Initialise la classe des opérations booléennes. * +* * +* Retour : - * +* * +* Remarques : - * +* * +******************************************************************************/ + +static void g_scan_set_match_counter_class_init(GScanSetMatchCounterClass *klass) +{ + GObjectClass *object; /* Autre version de la classe */ + GScanExpressionClass *expr; /* Version de classe parente */ + + object = G_OBJECT_CLASS(klass); + + object->dispose = (GObjectFinalizeFunc/* ! */)g_scan_set_match_counter_dispose; + object->finalize = (GObjectFinalizeFunc)g_scan_set_match_counter_finalize; + + expr = G_SCAN_EXPRESSION_CLASS(klass); + + expr->cmp_rich = (compare_expr_rich_fc)NULL; + expr->reduce = (reduce_expr_fc)g_scan_set_match_counter_reduce; + +} + + +/****************************************************************************** +* * +* Paramètres : op = instance à initialiser. * +* * +* Description : Initialise une instance d'opération booléenne. * +* * +* Retour : - * +* * +* Remarques : - * +* * +******************************************************************************/ + +static void g_scan_set_match_counter_init(GScanSetMatchCounter *counter) +{ + counter->patterns = NULL; + counter->count = 0; + + counter->type = SSCT_NONE; + counter->number = 0; + +} + + +/****************************************************************************** +* * +* Paramètres : op = instance d'objet GLib à traiter. * +* * +* Description : Supprime toutes les références externes. * +* * +* Retour : - * +* * +* Remarques : - * +* * +******************************************************************************/ + +static void g_scan_set_match_counter_dispose(GScanSetMatchCounter *counter) +{ + size_t i; /* Boucle de parcours */ + + for (i = 0; i < counter->count; i++) + g_clear_object(&counter->patterns[i]); + + G_OBJECT_CLASS(g_scan_set_match_counter_parent_class)->dispose(G_OBJECT(counter)); + +} + + +/****************************************************************************** +* * +* Paramètres : op = instance d'objet GLib à traiter. * +* * +* Description : Procède à la libération totale de la mémoire. * +* * +* Retour : - * +* * +* Remarques : - * +* * +******************************************************************************/ + +static void g_scan_set_match_counter_finalize(GScanSetMatchCounter *counter) +{ + if (counter->patterns != NULL) + free(counter->patterns); + + G_OBJECT_CLASS(g_scan_set_match_counter_parent_class)->finalize(G_OBJECT(counter)); + +} + + +/****************************************************************************** +* * +* Paramètres : patterns = motifs à impliquer. * +* count = quantité de ces motifs. * +* * +* Description : Constitue un décompte de motifs avec correspondances. * +* * +* Retour : Expression mise en place. * +* * +* Remarques : - * +* * +******************************************************************************/ + +GScanExpression *g_scan_set_match_counter_new(GSearchPattern ** const patterns, size_t count) +{ + GScanExpression *result; /* Structure à retourner */ + + result = g_object_new(G_TYPE_SCAN_SET_MATCH_COUNTER, NULL); + + if (!g_scan_set_match_counter_create(G_SCAN_SET_MATCH_COUNTER(result), patterns, count)) + g_clear_object(&result); + + return result; + +} + + +/****************************************************************************** +* * +* Paramètres : counter = instance à initialiser pleinement. * +* patterns = motifs à impliquer. * +* count = quantité de ces motifs. * +* * +* Description : Met en place un décompte de motifs avec correspondances. * +* * +* Retour : Bilan de l'opération. * +* * +* Remarques : - * +* * +******************************************************************************/ + +bool g_scan_set_match_counter_create(GScanSetMatchCounter *counter, GSearchPattern ** const patterns, size_t count) +{ + bool result; /* Bilan à retourner */ + size_t i; /* Boucle de parcours */ + + result = g_scan_expression_create(G_SCAN_EXPRESSION(counter), SRS_WAIT_FOR_SCAN); + if (!result) goto exit; + + counter->patterns = malloc(count * sizeof(GSearchPattern *)); + counter->count = count; + + for (i = 0; i < count; i++) + { + counter->patterns[i] = patterns[i]; + g_object_ref(G_OBJECT(patterns[i])); + } + + exit: + + return result; + +} + + +/****************************************************************************** +* * +* Paramètres : counter = décompte à compléter. * +* patterns = motifs à impliquer. * +* count = quantité de ces motifs. * +* * +* Description : Ajoute de nouveaux motifs à un ensemble à décompter. * +* * +* Retour : - * +* * +* Remarques : - * +* * +******************************************************************************/ + +void g_scan_set_match_counter_add_extra_patterns(GScanSetMatchCounter *counter, GSearchPattern ** const patterns, size_t count) +{ + size_t first; /* Premier emplacement libre */ + size_t i; /* Boucle de parcours */ + + first = counter->count; + + counter->count += count; + counter->patterns = realloc(counter->patterns, counter->count * sizeof(GSearchPattern *)); + + for (i = 0; i < count; i++) + { + counter->patterns[first + i] = patterns[i]; + g_object_ref(G_OBJECT(patterns[i])); + } + +} + + +/****************************************************************************** +* * +* Paramètres : counter = décompte à configurer. * +* type = type de décompte à considérer. * +* number = volume minimal de motifs avec correspondances. * +* * +* Description : Précise le volume de motifs avec correspondances à retrouver.* +* * +* Retour : Bilan de validité des arguments fournis. * +* * +* Remarques : - * +* * +******************************************************************************/ + +bool g_scan_set_match_counter_define_expected_matches(GScanSetMatchCounter *counter, ScanSetCounterType type, size_t *number) +{ + bool result; /* Bilan à retourner */ + + counter->type = type; + + if (type == SSCT_NUMBER) + { + counter->number = *number; + result = (counter->number <= counter->count); + } + else + result = true; + + return result; + +} + + + +/* ---------------------------------------------------------------------------------- */ +/* IMPLEMENTATION DES FONCTIONS DE CLASSE */ +/* ---------------------------------------------------------------------------------- */ + + +/****************************************************************************** +* * +* Paramètres : expr = expression à consulter. * +* ctx = contexte de suivi de l'analyse courante. * +* scope = portée courante des variables locales. * +* out = zone d'enregistrement de la réduction opérée. [OUT] * +* * +* Description : Réduit une expression à une forme plus simple. * +* * +* Retour : Bilan de l'opération : false en cas d'erreur irrécupérable. * +* * +* Remarques : - * +* * +******************************************************************************/ + +static ScanReductionState g_scan_set_match_counter_reduce(const GScanSetMatchCounter *expr, GScanContext *ctx, GScanScope *scope, GScanExpression **out) +{ + ScanReductionState result; /* Etat synthétisé à retourner */ + size_t matched; /* Qté de motifs avec résultats*/ + size_t i; /* Boucle de parcours */ + size_t count; /* Quantité de correspondances */ + bool status; /* Bilan d'évaluation finale */ + + if (g_scan_context_is_scan_done(ctx)) + { + matched = 0; + + for (i = 0; i < expr->count; i++) + { + g_scan_context_get_full_matches(ctx, expr->patterns[i], &count); + + if (count > 0) + matched++; + + } + + switch (expr->type) + { + case SSCT_NONE: + status = (matched == 0); + break; + + case SSCT_ANY: + status = (matched >= 1); + break; + + case SSCT_ALL: + status = (matched == expr->count); + break; + + case SSCT_NUMBER: + status = (matched >= expr->number); + break; + + } + + *out = g_scan_literal_expression_new(LVT_BOOLEAN, &status); + + result = SRS_REDUCED; + + } + else + result = SRS_WAIT_FOR_SCAN; + + return result; + +} diff --git a/src/analysis/scan/exprs/setcounter.h b/src/analysis/scan/exprs/setcounter.h new file mode 100644 index 0000000..59762f9 --- /dev/null +++ b/src/analysis/scan/exprs/setcounter.h @@ -0,0 +1,75 @@ + +/* Chrysalide - Outil d'analyse de fichiers binaires + * setcounter.h - prototypes pour le décompte global de correspondances locales + * + * Copyright (C) 2023 Cyrille Bagard + * + * This file is part of Chrysalide. + * + * Chrysalide is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * Chrysalide is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Foobar. If not, see . + */ + + +#ifndef _ANALYSIS_SCAN_EXPRS_SETCOUNTER_H +#define _ANALYSIS_SCAN_EXPRS_SETCOUNTER_H + + +#include + + +#include "../expr.h" +#include "../pattern.h" + + + +#define G_TYPE_SCAN_SET_MATCH_COUNTER g_scan_set_match_counter_get_type() +#define G_SCAN_SET_MATCH_COUNTER(obj) (G_TYPE_CHECK_INSTANCE_CAST((obj), G_TYPE_SCAN_SET_MATCH_COUNTER, GScanSetMatchCounter)) +#define G_IS_SCAN_SET_MATCH_COUNTER(obj) (G_TYPE_CHECK_INSTANCE_TYPE((obj), G_TYPE_SCAN_SET_MATCH_COUNTER)) +#define G_SCAN_SET_MATCH_COUNTER_CLASS(klass) (G_TYPE_CHECK_CLASS_CAST((klass), G_TYPE_SCAN_SET_MATCH_COUNTER, GScanSetMatchCounterClass)) +#define G_IS_SCAN_SET_MATCH_COUNTER_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE((klass), G_TYPE_SCAN_SET_MATCH_COUNTER)) +#define G_SCAN_SET_MATCH_COUNTER_GET_CLASS(obj) (G_TYPE_INSTANCE_GET_CLASS((obj), G_TYPE_SCAN_SET_MATCH_COUNTER, GScanSetMatchCounterClass)) + + +/* Décompte global de correspondances locales (instance) */ +typedef struct _GScanSetMatchCounter GScanSetMatchCounter; + +/* Décompte global de correspondances locales (classe) */ +typedef struct _GScanSetMatchCounterClass GScanSetMatchCounterClass; + + +/* Indique le type défini pour un décompte de résultats lors d'une recherche de motifs. */ +GType g_scan_set_match_counter_get_type(void); + +/* Met en place un décompte de correspondances obtenues. */ +GScanExpression *g_scan_set_match_counter_new(GSearchPattern ** const, size_t); + +/* Ajoute de nouveaux motifs à un ensemble à décompter. */ +void g_scan_set_match_counter_add_extra_patterns(GScanSetMatchCounter *, GSearchPattern ** const, size_t); + +/* Formes de volume de correspondances */ +typedef enum _ScanSetCounterType +{ + SSCT_NONE, /* Aucun motif avec résultats */ + SSCT_ANY, /* Au moins un motif trouvé */ + SSCT_ALL, /* Tous les motifs présents */ + SSCT_NUMBER, /* Au moins n motifs avec rés. */ + +} ScanSetCounterType; + +/* Précise le volume de motifs avec correspondances à retrouver. */ +bool g_scan_set_match_counter_define_expected_matches(GScanSetMatchCounter *, ScanSetCounterType, size_t *); + + + +#endif /* _ANALYSIS_SCAN_EXPRS_SETCOUNTER_H */ diff --git a/src/analysis/scan/grammar.y b/src/analysis/scan/grammar.y index 70382cf..9ee0f28 100644 --- a/src/analysis/scan/grammar.y +++ b/src/analysis/scan/grammar.y @@ -37,6 +37,7 @@ typedef void *yyscan_t; #include "exprs/literal.h" #include "exprs/logical.h" #include "exprs/set.h" +#include "exprs/setcounter.h" #include "exprs/relational.h" #include "exprs/strop.h" #include "patterns/modifier.h" @@ -128,6 +129,7 @@ YY_DECL; %token BYTES_ID +%token BYTES_FUZZY_ID %token BYTES_ID_COUNTER %token BYTES_ID_START %token BYTES_ID_LENGTH @@ -220,6 +222,7 @@ YY_DECL; %type INFO_KEY %type BYTES_ID +%type BYTES_FUZZY_ID %type BYTES_ID_COUNTER %type BYTES_ID_START %type BYTES_ID_LENGTH @@ -272,7 +275,9 @@ YY_DECL; %type relational_expr %type string_op %type arithm_expr -%type set_counter +%type set_match_counter +%type pattern_set +%type pattern_set_items %type set %type set_items %type set_access @@ -514,7 +519,7 @@ YY_DECL; char *_msg; int _ret; - _ret = asprintf(&_msg, _("unknown modifier: \"%s\""), $1.data); + _ret = asprintf(&_msg, _("Unknown modifier: \"%s\""), $1.data); if (_ret != -1) { @@ -839,7 +844,7 @@ YY_DECL; | relational_expr { $$ = $1; } | string_op { $$ = $1; } | arithm_expr { $$ = $1; } - | set_counter { $$ = $1; } + | set_match_counter { $$ = $1; } | set { $$ = $1; } | set_access { $$ = $1; } | intersection { $$ = $1; } @@ -993,10 +998,210 @@ relational_expr : cexpression "<" cexpression { $$ = g_scan_relational_operatio | cexpression "%" cexpression { $$ = g_scan_arithmetic_operation_new(AEO_MOD, $1, $3); } ; -set_counter : "none" "of" "them" { $$ = g_scan_literal_expression_new(LVT_BOOLEAN, (bool []){ true }); } - | "any" "of" "them" { $$ = g_scan_literal_expression_new(LVT_BOOLEAN, (bool []){ true }); } - | "all" "of" "them" { $$ = g_scan_literal_expression_new(LVT_BOOLEAN, (bool []){ true }); } - ; + + set_match_counter : "none" "of" pattern_set + { + GScanSetMatchCounter *__counter; + __counter = G_SCAN_SET_MATCH_COUNTER($3); + g_scan_set_match_counter_define_expected_matches(__counter, SSCT_NONE, NULL); + $$ = $3; + } + | "any" "of" pattern_set + { + GScanSetMatchCounter *__counter; + __counter = G_SCAN_SET_MATCH_COUNTER($3); + g_scan_set_match_counter_define_expected_matches(__counter, SSCT_ANY, NULL); + $$ = $3; + } + | "all" "of" pattern_set + { + GScanSetMatchCounter *__counter; + __counter = G_SCAN_SET_MATCH_COUNTER($3); + g_scan_set_match_counter_define_expected_matches(__counter, SSCT_ALL, NULL); + $$ = $3; + } + | UNSIGNED_INTEGER "of" pattern_set + { + GScanSetMatchCounter *__counter; + size_t __number; + bool __status; + + __counter = G_SCAN_SET_MATCH_COUNTER($3); + __number = $1; + + __status = g_scan_set_match_counter_define_expected_matches(__counter, + SSCT_NUMBER, &__number); + + if (!__status) + { + char *_msg; + int _ret; + + _ret = asprintf(&_msg, _("Expected matches counter too high: %zu"), __number); + + if (_ret != -1) + { + raise_error(_msg); + free(_msg); + } + + YYERROR; + } + + $$ = $3; + + } + ; + + pattern_set : "them" + { + size_t __count; + GSearchPattern **__patterns; + size_t __i; + + __patterns = g_scan_rule_get_local_variables(*built_rule, NULL, &__count); + + $$ = g_scan_set_match_counter_new(__patterns, __count); + + for (__i = 0; __i < __count; __i++) + g_object_unref(G_OBJECT(__patterns[__i])); + + free(__patterns); + + } + | "(" pattern_set_items ")" + { + $$ = $2; + } + ; + + pattern_set_items : BYTES_ID + { + GSearchPattern *__pat; + + __pat = g_scan_rule_get_local_variable(*built_rule, $1.data); + + if (__pat == NULL) + { + char *_msg; + int _ret; + + _ret = asprintf(&_msg, _("Pattern not found: \"%s\""), $1.data); + + if (_ret != -1) + { + raise_error(_msg); + free(_msg); + } + + YYERROR; + } + + $$ = g_scan_set_match_counter_new((GSearchPattern *[]) { __pat }, 1); + + g_object_unref(G_OBJECT(__pat)); + + } + | BYTES_FUZZY_ID + { + size_t __count; + GSearchPattern **__patterns; + size_t __i; + + __patterns = g_scan_rule_get_local_variables(*built_rule, $1.data, &__count); + + if (__count == 0) + { + char *_msg; + int _ret; + + _ret = asprintf(&_msg, _("Patterns not found: \"%s\""), $1.data); + + if (_ret != -1) + { + raise_error(_msg); + free(_msg); + } + + YYERROR; + } + + $$ = g_scan_set_match_counter_new(__patterns, __count); + + for (__i = 0; __i < __count; __i++) + g_object_unref(G_OBJECT(__patterns[__i])); + + free(__patterns); + + } + | pattern_set_items "," BYTES_ID + { + GSearchPattern *__pat; + GScanSetMatchCounter *__counter; + + __pat = g_scan_rule_get_local_variable(*built_rule, $3.data); + + if (__pat == NULL) + { + char *_msg; + int _ret; + + _ret = asprintf(&_msg, _("Pattern not found: \"%s\""), $3.data); + + if (_ret != -1) + { + raise_error(_msg); + free(_msg); + } + + YYERROR; + } + + __counter = G_SCAN_SET_MATCH_COUNTER($1); + g_scan_set_match_counter_add_extra_patterns(__counter, (GSearchPattern *[]) { __pat }, 1); + + g_object_unref(G_OBJECT(__pat)); + + $$ = $1; + + } + | pattern_set_items "," BYTES_FUZZY_ID + { + size_t __count; + GSearchPattern **__patterns; + GScanSetMatchCounter *__counter; + size_t __i; + + __patterns = g_scan_rule_get_local_variables(*built_rule, $3.data, &__count); + + if (__count == 0) + { + char *_msg; + int _ret; + + _ret = asprintf(&_msg, _("Patterns not found: \"%s\""), $3.data); + + if (_ret != -1) + { + raise_error(_msg); + free(_msg); + } + + YYERROR; + } + + __counter = G_SCAN_SET_MATCH_COUNTER($1); + g_scan_set_match_counter_add_extra_patterns(__counter, __patterns, __count); + + for (__i = 0; __i < __count; __i++) + g_object_unref(G_OBJECT(__patterns[__i])); + + free(__patterns); + + $$ = $1; + + } + ; set : "(" ")" diff --git a/src/analysis/scan/rule.c b/src/analysis/scan/rule.c index 1d68b80..7719e8a 100644 --- a/src/analysis/scan/rule.c +++ b/src/analysis/scan/rule.c @@ -25,12 +25,15 @@ #include -#include +#include +#include #include "rule-int.h" #include "matches/bytes.h" #include "patterns/token.h" +#include "../../common/extstr.h" +#include "../../core/logs.h" @@ -276,6 +279,108 @@ GSearchPattern *g_scan_rule_get_local_variable(GScanRule *rule, const char *targ /****************************************************************************** * * +* Paramètres : rule = règle de détection à consulter. * +* target = nom d'une variable locale à retrouver. * +* count = quantité de motifs renvoyés. [OUT] * +* * +* Description : Fournit une liste de variables locales à partir d'un nom. * +* * +* Retour : Motifs de détection retrouvés ou NULL en cas d'échec. * +* * +* Remarques : - * +* * +******************************************************************************/ + +GSearchPattern **g_scan_rule_get_local_variables(GScanRule *rule, const char *target, size_t *count) +{ + GSearchPattern **result; /* Variables à retourner */ + size_t i; /* Boucle de parcours */ + char *regex; /* Définition complète */ + regex_t preg; /* Expression compilée */ + int ret; /* Bilan d'un appel */ + const char *name; /* Désignation d'un motif */ + + result = NULL; + + *count = 0; + + /* Premier cas de figure : la liste complète est attendue */ + + if (target == NULL) + { + *count = rule->bytes_used; + result = malloc(*count * sizeof(GSearchPattern *)); + + for (i = 0; i < rule->bytes_used; i++) + { + result[i] = rule->bytes_locals[i]; + g_object_ref(G_OBJECT(result[i])); + } + + } + + /* Second cas de figure : une expression régulière est vraisemblablement de mise */ + + else + { + regex = strdup(target); + + regex = strrpl(regex, "*", ".*"); + regex = strprep(regex, "^"); + regex = stradd(regex, "$"); + + printf("regex: %s\n", regex); + + ret = regcomp(&preg, regex, REG_NOSUB); + + if (ret != 0) + { + LOG_ERROR_REGCOMP(&preg, ret); + goto done; + } + + result = malloc(rule->bytes_used * sizeof(GSearchPattern *)); + + for (i = 0; i < rule->bytes_used; i++) + { + name = g_search_pattern_get_name(rule->bytes_locals[i]); + + ret = regexec(&preg, name, 0, NULL, 0); + + if (ret != REG_NOMATCH) + { + result[*count] = rule->bytes_locals[i]; + g_object_ref(G_OBJECT(result[*count])); + + (*count)++; + + } + + } + + printf(" ==> found: %zu patterns for '%s'\n", *count, target); + + if (*count == 0) + { + free(result); + result = NULL; + } + + regfree(&preg); + + done: + + free(regex); + + } + + return result; + +} + + +/****************************************************************************** +* * * Paramètres : rule = règle de détection à compléter. * * expr = expression de condition à satisfaire. * * * diff --git a/src/analysis/scan/rule.h b/src/analysis/scan/rule.h index cb2c287..20a688c 100644 --- a/src/analysis/scan/rule.h +++ b/src/analysis/scan/rule.h @@ -68,6 +68,9 @@ void g_scan_rule_add_local_variable(GScanRule *, GSearchPattern *); /* Fournit une variable locale à une règle selon un nom. */ GSearchPattern *g_scan_rule_get_local_variable(GScanRule *, const char *); +/* Fournit une liste de variables locales à partir d'un nom. */ +GSearchPattern **g_scan_rule_get_local_variables(GScanRule *, const char *, size_t *); + /* Définit l'expression d'une correspondance recherchée. */ void g_scan_rule_set_match_condition(GScanRule *, GScanExpression *); diff --git a/src/analysis/scan/tokens.l b/src/analysis/scan/tokens.l index 1cf65fb..92cc858 100644 --- a/src/analysis/scan/tokens.l +++ b/src/analysis/scan/tokens.l @@ -368,6 +368,7 @@ reg_classes \\w|\\W|\\s|\\S|\\d|\\D|\\b|\\B bytes_id [A-Za-z_][A-Za-z0-9_]* +bytes_fuzzy_id [\*A-Za-z_][\*A-Za-z0-9_]* %% @@ -903,6 +904,12 @@ bytes_id [A-Za-z_][A-Za-z0-9_]* return BYTES_ID; } + ${bytes_fuzzy_id} { + yylval->sized_cstring.data = yytext + 1; + yylval->sized_cstring.len = yyleng - 1; + return BYTES_FUZZY_ID; + } + #{bytes_id} { yylval->sized_cstring.data = yytext + 1; yylval->sized_cstring.len = yyleng - 1; -- cgit v0.11.2-87-g4458