root/pehunter/pehunter.h

Revision 1148, 4.6 kB (checked in by till, 1 year ago)

some robustness...

Line 
1 /*
2  * pehunter.h
3  *
4  * This program is free software; you can redistribute it and/or modify
5  * it under the terms of the GNU General Public License as published by
6  * the Free Software Foundation; either version 2 of the License, or
7  * (at your option) any later version.
8  *
9  * This program is distributed in the hope that it will be useful,
10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12  * GNU General Public License for more details.
13  *
14  * You should have received a copy of the GNU General Public License
15  * along with this program; if not, write to the Free Software
16  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
17  *
18  * Copyright (C) 2007 Tillmann Werner <tillmann.werner@gmx.de>
19  */
20
21 #ifndef __PEHUNTER_H__
22 #define __PEHUNTER_H__
23
24 #include "sf_snort_packet.h"
25 #include "sf_dynamic_preprocessor.h"
26
27 #include "spp_pehunter.h"
28
29
30 /* PE file format stuff below taken from winnt.h */
31
32 #define IMAGE_DOS_SIGNATURE                     0x5A4D          // MZ
33 #define IMAGE_NT_SIGNATURE                      0x00004550      // PE00
34 #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES        16
35 #define IMAGE_SIZEOF_SHORT_NAME                 8
36 #define IMAGE_SIZEOF_SECTION_HEADER             40
37
38 typedef struct _IMAGE_SECTION_HEADER {
39         char    Name[IMAGE_SIZEOF_SHORT_NAME];
40         union {
41                 u_int32_t       PhysicalAddress;
42                 u_int32_t       VirtualSize;
43         } Misc;
44         u_int32_t       VirtualAddress;
45         u_int32_t       SizeOfRawData;
46         u_int32_t       PointerToRawData;
47         u_int32_t       PointerToRelocations;
48         u_int32_t       PointerToLinenumbers;
49         u_int16_t       NumberOfRelocations;
50         u_int16_t       NumberOfLinenumbers;
51         u_int32_t       Characteristics;
52 } IMAGE_SECTION_HEADER;
53
54 typedef struct _IMAGE_DATA_DIRECTORY {
55   u_int32_t     VirtualAddress;
56   u_int32_t     Size;
57 } IMAGE_DATA_DIRECTORY;
58
59 typedef struct _IMAGE_FILE_HEADER {
60         u_int16_t       Machine;
61         u_int16_t       NumberOfSections;
62         u_int32_t       TimeDateStamp;
63         u_int32_t       PointerToSymbolTable;
64         u_int32_t       NumberOfSymbols;
65         u_int16_t       SizeOfOptionalHeader;
66         u_int16_t       Characteristics;
67 } IMAGE_FILE_HEADER;
68
69 typedef struct _IMAGE_OPTIONAL_HEADER {
70
71   /* Standard fields */
72   u_int16_t     Magic;
73   u_int8_t      MajorLinkerVersion;
74   u_int8_t      MinorLinkerVersion;
75   u_int32_t     SizeOfCode;
76   u_int32_t     SizeOfInitializedData;
77   u_int32_t     SizeOfUninitializedData;
78   u_int32_t     AddressOfEntryPoint;
79   u_int32_t     BaseOfCode;
80   u_int32_t     BaseOfData;
81
82   /* NT additional fields */
83   u_int32_t     ImageBase;
84   u_int32_t     SectionAlignment;
85   u_int32_t     FileAlignment;
86   u_int16_t     MajorOperatingSystemVersion;
87   u_int16_t     MinorOperatingSystemVersion;
88   u_int16_t     MajorImageVersion;
89   u_int16_t     MinorImageVersion;
90   u_int16_t     MajorSubsystemVersion;
91   u_int16_t     MinorSubsystemVersion;
92   u_int32_t     Win32VersionValue;
93   u_int32_t     SizeOfImage;
94   u_int32_t     SizeOfHeaders;
95   u_int32_t     CheckSum;
96   u_int16_t     Subsystem;
97   u_int16_t     DllCharacteristics;
98   u_int32_t     SizeOfStackReserve;
99   u_int32_t     SizeOfStackCommit;
100   u_int32_t     SizeOfHeapReserve;
101   u_int32_t     SizeOfHeapCommit;
102   u_int32_t     LoaderFlags;
103   u_int32_t     NumberOfRvaAndSizes;
104   IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; // 0x60
105 } IMAGE_OPTIONAL_HEADER32;
106
107 typedef struct _IMAGE_DOS_HEADER {
108         u_int16_t e_magic;                      // 00: MZ Header signature
109         u_int16_t e_cblp;                       // 02: Bytes on last page of file
110         u_int16_t e_cp;                         // 04: Pages in file
111         u_int16_t e_crlc;                       // 06: Relocations
112         u_int16_t e_cparhdr;                    // 08: Size of header in paragraphs
113         u_int16_t e_minalloc;                   // 0a: Minimum extra paragraphs needed
114         u_int16_t e_maxalloc;                   // 0c: Maximum extra paragraphs needed
115         u_int16_t e_ss;                         // 0e: Initial (relative) SS value
116         u_int16_t e_sp;                         // 10: Initial SP value
117         u_int16_t e_csum;                       // 12: Checksum
118         u_int16_t e_ip;                         // 14: Initial IP value
119         u_int16_t e_cs;                         // 16: Initial (relative) CS value
120         u_int16_t e_lfarlc;                     // 18: File address of relocation table
121         u_int16_t e_ovno;                       // 1a: Overlay number
122         u_int16_t e_res[4];                     // 1c: Reserved words
123         u_int16_t e_oemid;                      // OEM identifier (for e_oeminfo)
124         u_int16_t e_oeminfo;                    // 26: OEM information; e_oemid specific
125         u_int16_t e_res2[10];                   // 28: Reserved words
126         u_int32_t e_lfanew;                     // 3c: Offset to extended header
127 } IMAGE_DOS_HEADER;
128
129 typedef struct _IMAGE_NT_HEADERS {
130         u_int32_t       Signature;              // "PE00"
131         IMAGE_FILE_HEADER FileHeader;           // 0x04
132         IMAGE_OPTIONAL_HEADER32 OptionalHeader; // 0x18
133 } IMAGE_NT_HEADERS32;
134
135 /* end of PE file format stuff */
136
137
138 typedef struct _SessionData {
139         u_int8_t                match;
140         u_int8_t                dumped;
141         u_int32_t               len;
142         u_int32_t               matchpos;
143         u_int32_t               filelen;
144         u_char                  *data;
145         IMAGE_DOS_HEADER        *dosHeader;
146         IMAGE_NT_HEADERS32      *peHeader;
147         IMAGE_SECTION_HEADER    *sectHeader;
148 } SessionData;
149
150 int Hunt(SFSnortPacket *p);
151
152 #endif  /* __PEHUNTER_H__ */
Note: See TracBrowser for help on using the browser.