Changeset 1148 for pehunter

Show
Ignore:
Timestamp:
03/20/07 22:41:23 (1 year ago)
Author:
till
Message:

some robustness...

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • pehunter/README

    r1134 r1148  
    1 PE Hunter is a plugin for snort (aka dynamic preprocessor) which extracts 
    2 Windows executables (files in PE format) from the network stream and dumps them 
    3 to disk. 
     1PE Hunter is a plugin for snort (aka dynamic preprocessor) for extracting  
     2Windows executables (files in PE format) from the network stream. 
    43 
    54It first spots a PE header and then uses a simple heuristik to calculate the 
    6 file length. Starting at the position of the header, the resulting number of 
     5file length. Starting at the header offset in a stream, the resulting number of 
    76bytes is then dumped to a file. 
    87 

  • pehunter/pehunter.c

    r1134 r1148  
    196196 
    197197        /* Spot DOS header */ 
    198         if ((session_data->len - parsedBytes) < sizeof(IMAGE_DOS_HEADER)) return(0); 
     198        if (session_data->len < (sizeof(IMAGE_DOS_HEADER) + parsedBytes)) return(0); 
    199199        dosHeader = (IMAGE_DOS_HEADER *)(session_data->data + parsedBytes); 
    200200        if (dosHeader->e_magic != IMAGE_DOS_SIGNATURE) return(0); 
    …… 
    202202        if (_pehunterConfig.debug) _dpd.logMsg("DOS header found at offset %lu.\n", pos); 
    203203 
    204         if ((session_data->len - parsedBytes - dosHeader->e_lfanew) < sizeof(IMAGE_NT_HEADERS32)) return(0); 
     204        if (session_data->len < (sizeof(IMAGE_NT_HEADERS32) + parsedBytes + dosHeader->e_lfanew)) return(0); 
    205205        parsedBytes += dosHeader->e_lfanew; 
     206        if (_pehunterConfig.debug) _dpd.logMsg("DOS header e_lfanew is %lu, parsedBytes is %lu.\n", dosHeader->e_lfanew, parsedBytes); 
    206207 
    207208        /* image file header */ 
     209        if ((session_data->len) < (sizeof(IMAGE_NT_HEADERS32) + parsedBytes)) return(0); 
    208210        peHeader = (IMAGE_NT_HEADERS32*)(session_data->data + parsedBytes); 
    209211        if (peHeader->Signature == IMAGE_NT_SIGNATURE) 
    210212        { 
    211213                if (_pehunterConfig.debug) _dpd.logMsg("NT header found at offset %lu.\n", parsedBytes); 
    212                 if ((session_data->len - parsedBytes) < sizeof(IMAGE_NT_HEADERS32)) return(0); 
    213214                parsedBytes += sizeof(IMAGE_NT_HEADERS32); 
    214  
    215215 
    216216                /* loop through section table */ 
    217217                for (i=0; i<peHeader->FileHeader.NumberOfSections; i++) { 
    218                         if ((session_data->len - parsedBytes) < sizeof(IMAGE_SECTION_HEADER)) return(0); 
     218                        if (session_data->len < (sizeof(IMAGE_SECTION_HEADER) + parsedBytes)) return(0); 
    219219                        sectHeader = (IMAGE_SECTION_HEADER *)(session_data->data + parsedBytes); 
     220                        if (_pehunterConfig.debug) _dpd.logMsg("Section header found at offset %lu.\n", parsedBytes); 
    220221                        parsedBytes += sizeof(IMAGE_SECTION_HEADER); 
    221                         if (_pehunterConfig.debug) _dpd.logMsg("Section %u: starts at offset %u (%u bytes)\n", 
    222                                 i, sectHeader->PointerToRawData, sectHeader->SizeOfRawData); 
     222                        if (_pehunterConfig.debug) _dpd.logMsg("Section %lu (%s): starts at offset %lu (%u bytes)\n", 
     223                                i, sectHeader->Name, sectHeader->PointerToRawData, sectHeader->SizeOfRawData); 
    223224                        if (maxOffset < sectHeader->PointerToRawData) { 
    224225                                maxOffset       = sectHeader->PointerToRawData; 

  • pehunter/pehunter.h

    r1134 r1148  
    3737 
    3838typedef struct _IMAGE_SECTION_HEADER { 
    39         u_int8_t      Name[IMAGE_SIZEOF_SHORT_NAME]; 
     39        char  Name[IMAGE_SIZEOF_SHORT_NAME]; 
    4040        union { 
    4141                u_int32_t       PhysicalAddress;