root/pehunter/pehunter.c

/*
 * pehunter.c
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 *
 * Copyright (C) 2007 Tillmann Werner <tillmann.werner@gmx.de>
 */

#include <unistd.h>
#include <string.h>
#include <errno.h>

#include "sf_snort_plugin_api.h"
#include "sf_snort_packet.h"
#include "debug.h"

#include "pehunter.h"
#include "md5.h"

#include "profiler.h"
#ifdef PERF_PROFILING
PreprocStats pehuntPerfStats;
PreprocStats pehuntDetectPerfStats;
int pehuntDetectCalled = 0;
#endif


extern DynamicPreprocessorData _dpd;

SessionData *_pehunt;


static void PEHunter_SessionFree(void * v)
{
        SessionData *sdata = (SessionData *) v;

        if (sdata)
        {
                if ( sdata->data ) free(sdata->data);
                free(sdata);
        }
        return;
}



SessionData *PEHunter_Setup(SFSnortPacket *p)
{
        SessionData *datap = NULL;

        if (( !p ) || ( !p->stream_session_ptr )) return(NULL);
        if ( !_dpd.streamAPI )
        {
                DEBUG_WRAP(_dpd.debugMsg(DEBUG_PEHUNTER, "Error: Failed to get Stream API - Stream not enabled?\n"););
                return(NULL);
        }

        /* Get session pointer */
        if (( datap = _dpd.streamAPI->get_application_data(p->stream_session_ptr, PP_PEHUNTER)) == NULL)
        {
                if ((datap = (SessionData *) malloc(sizeof(SessionData))) == NULL)
                {
                        _dpd.fatalMsg("%s(%d) => Failed to allocate memory for session data\n");
                        return(NULL);
                }

                /* Initialize state for first packet */
                bzero(datap, sizeof(SessionData));
                _dpd.streamAPI->set_application_data(p->stream_session_ptr, PP_PEHUNTER, datap, &PEHunter_SessionFree);
        }

        return(datap);
}

/*
 * Function: Hunt()
 *
 * Purpose: Search for PE magic byte sequence in stream,
 * locate PE header, extract length and dump extracted PE into a file
 *
 * Arguments: Snort packet.
 *
 * Returns: void
 *
 */
int Hunt(SFSnortPacket *p)
{
        int                     retval;
        u_int32_t               parsedBytes, dosOffset, maxOffset, maxLen, i, parseStart, pos;
        IMAGE_DOS_HEADER        *dosHeader;
        IMAGE_NT_HEADERS32      *peHeader;
        IMAGE_SECTION_HEADER    *sectHeader;
        SessionData             *session_data;
        const char              *dh_sig = "MZ";
        char                    *filename;
        FILE                    *dumpfile;
        PROFILE_VARS;

        dumpfile        = NULL;
        filename        = NULL;
        session_data    = NULL;
        parsedBytes     = 0;
        maxOffset       = 0;
        maxLen          = 0;

        /* ignore if no data */
        if (( !p->payload ) || ( !p->payload_size ))
        {
                return(0);
        }

        if ( (session_data = PEHunter_Setup(p)) == NULL)
        {
                /* Could not get/create the session data for this packet. */
                PREPROC_PROFILE_END(pehuntPerfStats);
                return(0);
        }

        if (session_data->dumped)
        {
                /* file already extracted */
                return(1);
        }
        
        /* Append payload to session data */
        if ((session_data->data = (u_char *) realloc(session_data->data, session_data->len + p->payload_size)) == NULL)
        {
                _dpd.fatalMsg("%s(%d) => Failed to allocate memory for session data\n");
                return(0);
        }

        parseStart = (session_data->len ? (session_data->len-1) : 0);
        memcpy(session_data->data + session_data->len, p->payload, p->payload_size);
        session_data->len += p->payload_size;

        if (session_data->match && (session_data->len >= (session_data->matchpos + session_data->filelen)))
        {
                /*
                if (chdir(_pehunterConfig.dumpDir) == -1)
                {
                        _dpd.fatalMsg("%s(): Unable to change into %s: %s\n", __PRETTY_FUNCTION__, _pehunterConfig.dumpDir, strerror(errno));
                }
                */
                if ((filename = strdup(_pehunterConfig.dumpDir)) == NULL)
                {
                        _dpd.fatalMsg("%s(): Unable to allocate memory: %s\n", __PRETTY_FUNCTION__, strerror(errno));
                }
                if ((filename = realloc(filename, strlen(filename)+34)) == NULL) {
                        _dpd.fatalMsg("%s(): Unable to allocate memory: %s\n", __PRETTY_FUNCTION__, strerror(errno));
                }
                
                /* assemble filename */
                bzero(filename+strlen(filename), 34);
                strncat(filename, "/", 1);
                mem_md5sum(session_data->data+session_data->matchpos, session_data->filelen);
                strncat(filename, mem_md5sum(session_data->data+session_data->matchpos, session_data->filelen), 32);

                if ((dumpfile = fopen(filename, "w")) == NULL)
                {
                        _dpd.fatalMsg("%s(): Unable to open dumpfile %s: %s\n", __PRETTY_FUNCTION__, filename, strerror(errno));
                }
                if ((retval = fwrite(session_data->data+session_data->matchpos, 1, session_data->filelen, dumpfile)) < session_data->filelen)
                {
                        _dpd.fatalMsg("%s(): Unable to write dumpfile %s (%u bytes written): %s\n", __PRETTY_FUNCTION__, filename, retval, strerror(errno));
                }
                if (fclose(dumpfile) == EOF)
                {
                        _dpd.fatalMsg("%s(): Unable to close dumpfile %s: %s\n", __PRETTY_FUNCTION__, filename, strerror(errno));
                }
                session_data->dumped = 1;
                _dpd.logMsg("PE file extracted: %u bytes dumped to %s.\n", session_data->filelen, filename);
                free(filename);
                
                return(1);
        }


         /* Check for DOS header signature */
        for (dosOffset=parseStart; (dosOffset + strlen(dh_sig)) < session_data->len; dosOffset++) 
        {
                if (memcmp(session_data->data + dosOffset, dh_sig, strlen(dh_sig)) == 0) break;
        }
        parsedBytes = dosOffset - parseStart;

        /* Spot DOS header */
        if (session_data->len < (sizeof(IMAGE_DOS_HEADER) + parsedBytes)) return(0);
        dosHeader = (IMAGE_DOS_HEADER *)(session_data->data + parsedBytes);
        if (dosHeader->e_magic != IMAGE_DOS_SIGNATURE) return(0);
        pos = parsedBytes;
        if (_pehunterConfig.debug) _dpd.logMsg("DOS header found at offset %lu.\n", pos);

        if (session_data->len < (sizeof(IMAGE_NT_HEADERS32) + parsedBytes + dosHeader->e_lfanew)) return(0);
        parsedBytes += dosHeader->e_lfanew;
        if (_pehunterConfig.debug) _dpd.logMsg("DOS header e_lfanew is %lu, parsedBytes is %lu.\n", dosHeader->e_lfanew, parsedBytes);

        /* image file header */
        if ((session_data->len) < (sizeof(IMAGE_NT_HEADERS32) + parsedBytes)) return(0);
        peHeader = (IMAGE_NT_HEADERS32*)(session_data->data + parsedBytes);
        if (peHeader->Signature == IMAGE_NT_SIGNATURE)
        {
                if (_pehunterConfig.debug) _dpd.logMsg("NT header found at offset %lu.\n", parsedBytes);
                parsedBytes += sizeof(IMAGE_NT_HEADERS32);

                /* loop through section table */
                for (i=0; i<peHeader->FileHeader.NumberOfSections; i++) {
                        if (session_data->len < (sizeof(IMAGE_SECTION_HEADER) + parsedBytes)) return(0);
                        sectHeader = (IMAGE_SECTION_HEADER *)(session_data->data + parsedBytes);
                        if (_pehunterConfig.debug) _dpd.logMsg("Section header found at offset %lu.\n", parsedBytes);
                        parsedBytes += sizeof(IMAGE_SECTION_HEADER);
                        if (_pehunterConfig.debug) _dpd.logMsg("Section %lu (%s): starts at offset %lu (%u bytes)\n",
                                i, sectHeader->Name, sectHeader->PointerToRawData, sectHeader->SizeOfRawData);
                        if (maxOffset < sectHeader->PointerToRawData) {
                                maxOffset       = sectHeader->PointerToRawData;
                                maxLen          = sectHeader->SizeOfRawData;
                        }
                }
        }
        if (maxOffset + maxLen)
        {
                session_data->match     = 1;
                session_data->matchpos  = pos;
                session_data->filelen   = maxOffset + maxLen;
        }

        return(0);
}