Improvement to the detection of multiple packers. #804
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
To prevent false positives, we should check whether the size of the very first section of the file is zero. If it is not, then we either have a modified packer, already unpacked file that has the packer's section names, or a file that tries to pretend it is packed with UPX. This should reduce the amount of false positives significantly.
…ection. The data block containing a magic value "UPX!" followed by an internal structure must be placed before the first section. This check will remove false positive detection of unpacked files dumped from memory that retained that information.
Ramnit is a file-infector and should not be detected as a tool.
By rigorously checking the imported API and the presence of the string in only executable sections of the file we ensure that only truly packed files are detected. Otherwise a false positive detection could occur when a file was doubly packed and the byte pattern was stored in unmodified form in the data section, or when a packed file was stored in resources or overlay.
The rule itself searches for a string "kernel32.dll" that sits in the middle of zeroed bytes. This does not actually check for code/data from Themida and can be easily present in regular files.
This rule matches a common windows runtime code from older versions of Visual Studio (6.0).
This rule matches code that is not specific to MEW. If the entrypoint starts with a E9 call and is followed by empty space. It will always match.
This rule matches code that is not specific to tElock. If the entrypoint starts with a E9 call and is followed by empty space. It will always match.
The generic Ste@lth YARA rule was checking for the presence of a single instruction. Not only it is slow, it is also highly inaccurate. The YARA rule was replaced with a correct one and an old rule for version 1.1 was left behind for backwards compatibility.
This version was previously covered by highly ambiguous YARA rule that has been since removed. In its stead, this YARA rule was added.
To keep things consistent, we should use the same name for cases where there are historically two possibilities. Thus, we should rename WinUpack to simply Upack.
For the sake of uniformity, we should use consistent naming.
…tion. The code that this specific YARA rule detects belongs to ASProtect rather than to ASPack and it should be detected as such.
The !EP ExePack and AHPack are the same product under different names. They both use the same code and therefore should be detected as with the same name.
The detected code was created by Themida, not by RLPack and should be marked as such.
|
Let's run TC tests. |
s3rvac
approved these changes
Jul 14, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR changes the following:
Added:
Ste@lthpacker.Removed:
Themida,InstallShield,MEW,tElock,Ste@lth).AHPackrule sinceAHPackand!EP ExeCryptare the same product with different names.RLPack. It was detecting code that was generated byThemidaImproved:
WinUpacktoUpackfor consistency.yoda's Crytpertoyoda's Protectorfor consistency.ASPackrule toASProtectas it was detecting the code that is only present inASProtect.Corresponding tests