diff -Naur snort-2.8.2.2/configure.in snort-2.8.2.2-pehunter/configure.in --- snort-2.8.2.2/configure.in 2008-05-07 17:37:33.000000000 +0200 +++ snort-2.8.2.2-pehunter/configure.in 2008-06-01 22:46:32.000000000 +0200 @@ -1464,6 +1464,7 @@ src/dynamic-examples/dynamic-preprocessor/Makefile \ src/dynamic-examples/dynamic-rule/Makefile \ src/dynamic-preprocessors/ssl/Makefile \ +src/dynamic-preprocessors/pehunter/Makefile \ src/output-plugins/Makefile \ src/preprocessors/Makefile \ src/preprocessors/HttpInspect/Makefile \ diff -Naur snort-2.8.2.2/src/dynamic-preprocessors/Makefile.am snort-2.8.2.2-pehunter/src/dynamic-preprocessors/Makefile.am --- snort-2.8.2.2/src/dynamic-preprocessors/Makefile.am 2007-11-13 19:35:07.000000000 +0100 +++ snort-2.8.2.2-pehunter/src/dynamic-preprocessors/Makefile.am 2008-06-01 22:31:02.000000000 +0200 @@ -215,7 +215,7 @@ INCLUDES = @INCLUDES@ if HAVE_DYNAMIC_PLUGINS -SUBDIRS = libs ftptelnet smtp ssh dcerpc dns ssl +SUBDIRS = libs ftptelnet smtp ssh dcerpc dns ssl pehunter endif clean-local: diff -Naur snort-2.8.2.2/src/dynamic-preprocessors/pehunter/Makefile.am snort-2.8.2.2-pehunter/src/dynamic-preprocessors/pehunter/Makefile.am --- snort-2.8.2.2/src/dynamic-preprocessors/pehunter/Makefile.am 1970-01-01 01:00:00.000000000 +0100 +++ snort-2.8.2.2-pehunter/src/dynamic-preprocessors/pehunter/Makefile.am 2008-06-01 22:31:40.000000000 +0200 @@ -0,0 +1,34 @@ +## $Id +AUTOMAKE_OPTIONS=foreign no-dependencies + +INCLUDES = -I../include + +libdir = ${exec_prefix}/lib/snort_dynamicpreprocessor + +lib_LTLIBRARIES = libsf_pehunter_preproc.la + +libsf_pehunter_preproc_la_LDFLAGS = -module + +BUILT_SOURCES = \ +sf_dynamic_preproc_lib.c + +nodist_libsf_pehunter_preproc_la_SOURCES = \ +sf_dynamic_preproc_lib.c + +libsf_pehunter_preproc_la_SOURCES = \ +spp_pehunter.c spp_pehunter.h \ +pehunter.c pehunter.h \ +md5.c md5.h \ +sf_preproc_info.h + +EXTRA_DIST = \ +sf_pehunter.dsp + +sf_dynamic_preproc_lib.c: ../include/sf_dynamic_preproc_lib.c + cp $? $@ + +all-local: + $(MAKE) DESTDIR=$(PWD)/../build install-libLTLIBRARIES + +clean-local: + rm -f sf_dynamic_preproc_lib.c diff -Naur snort-2.8.2.2/src/dynamic-preprocessors/pehunter/Makefile.in snort-2.8.2.2-pehunter/src/dynamic-preprocessors/pehunter/Makefile.in --- snort-2.8.2.2/src/dynamic-preprocessors/pehunter/Makefile.in 1970-01-01 01:00:00.000000000 +0100 +++ snort-2.8.2.2-pehunter/src/dynamic-preprocessors/pehunter/Makefile.in 2008-06-01 22:31:40.000000000 +0200 @@ -0,0 +1,475 @@ +# Makefile.in generated by automake 1.9.5 from Makefile.am. +# @configure_input@ + +# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, +# 2003, 2004, 2005 Free Software Foundation, Inc. +# This Makefile.in is free software; the Free Software Foundation +# gives unlimited permission to copy and/or distribute it, +# with or without modifications, as long as this notice is preserved. + +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY, to the extent permitted by law; without +# even the implied warranty of MERCHANTABILITY or FITNESS FOR A +# PARTICULAR PURPOSE. + +@SET_MAKE@ + +SOURCES = $(libsf_pehunter_preproc_la_SOURCES) $(nodist_libsf_pehunter_preproc_la_SOURCES) + +srcdir = @srcdir@ +top_srcdir = @top_srcdir@ +VPATH = @srcdir@ +pkgdatadir = $(datadir)/@PACKAGE@ +pkglibdir = $(libdir)/@PACKAGE@ +pkgincludedir = $(includedir)/@PACKAGE@ +top_builddir = ../../.. +am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd +INSTALL = @INSTALL@ +install_sh_DATA = $(install_sh) -c -m 644 +install_sh_PROGRAM = $(install_sh) -c +install_sh_SCRIPT = $(install_sh) -c +INSTALL_HEADER = $(INSTALL_DATA) +transform = $(program_transform_name) +NORMAL_INSTALL = : +PRE_INSTALL = : +POST_INSTALL = : +NORMAL_UNINSTALL = : +PRE_UNINSTALL = : +POST_UNINSTALL = : +build_triplet = @build@ +host_triplet = @host@ +subdir = src/dynamic-preprocessors/pehunter +DIST_COMMON = README $(srcdir)/Makefile.am $(srcdir)/Makefile.in +ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 +am__aclocal_m4_deps = $(top_srcdir)/configure.in +am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ + $(ACLOCAL_M4) +mkinstalldirs = $(SHELL) $(top_srcdir)/mkinstalldirs +CONFIG_HEADER = $(top_builddir)/config.h +CONFIG_CLEAN_FILES = +am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; +am__vpath_adj = case $$p in \ + $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \ + *) f=$$p;; \ + esac; +am__strip_dir = `echo $$p | sed -e 's|^.*/||'`; +am__installdirs = "$(DESTDIR)$(libdir)" +libLTLIBRARIES_INSTALL = $(INSTALL) +LTLIBRARIES = $(lib_LTLIBRARIES) +libsf_pehunter_preproc_la_LIBADD = +am_libsf_pehunter_preproc_la_OBJECTS = spp_pehunter.lo pehunter.lo \ + md5.lo +nodist_libsf_pehunter_preproc_la_OBJECTS = sf_dynamic_preproc_lib.lo +libsf_pehunter_preproc_la_OBJECTS = \ + $(am_libsf_pehunter_preproc_la_OBJECTS) \ + $(nodist_libsf_pehunter_preproc_la_OBJECTS) +DEFAULT_INCLUDES = -I. -I$(srcdir) -I$(top_builddir) +depcomp = +am__depfiles_maybe = +COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \ + $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) +LTCOMPILE = $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) \ + $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \ + $(AM_CFLAGS) $(CFLAGS) +CCLD = $(CC) +LINK = $(LIBTOOL) --tag=CC --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ + $(AM_LDFLAGS) $(LDFLAGS) -o $@ +SOURCES = $(libsf_pehunter_preproc_la_SOURCES) \ + $(nodist_libsf_pehunter_preproc_la_SOURCES) +DIST_SOURCES = $(libsf_pehunter_preproc_la_SOURCES) +ETAGS = etags +CTAGS = ctags +DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) +ACLOCAL = @ACLOCAL@ +AMDEP_FALSE = @AMDEP_FALSE@ +AMDEP_TRUE = @AMDEP_TRUE@ +AMTAR = @AMTAR@ +AR = @AR@ +AUTOCONF = @AUTOCONF@ +AUTOHEADER = @AUTOHEADER@ +AUTOMAKE = @AUTOMAKE@ +AWK = @AWK@ +CC = @CC@ +CCDEPMODE = @CCDEPMODE@ +CFLAGS = @CFLAGS@ +CPP = @CPP@ +CPPFLAGS = @CPPFLAGS@ +CXX = @CXX@ +CXXCPP = @CXXCPP@ +CXXDEPMODE = @CXXDEPMODE@ +CXXFLAGS = @CXXFLAGS@ +CYGPATH_W = @CYGPATH_W@ +DEFS = @DEFS@ +DEPDIR = @DEPDIR@ +ECHO = @ECHO@ +ECHO_C = @ECHO_C@ +ECHO_N = @ECHO_N@ +ECHO_T = @ECHO_T@ +EGREP = @EGREP@ +EXEEXT = @EXEEXT@ +F77 = @F77@ +FFLAGS = @FFLAGS@ +HAVE_DYNAMIC_PLUGINS_FALSE = @HAVE_DYNAMIC_PLUGINS_FALSE@ +HAVE_DYNAMIC_PLUGINS_TRUE = @HAVE_DYNAMIC_PLUGINS_TRUE@ +INCLUDES = -I../include +INSTALL_DATA = @INSTALL_DATA@ +INSTALL_PROGRAM = @INSTALL_PROGRAM@ +INSTALL_SCRIPT = @INSTALL_SCRIPT@ +INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ +LDFLAGS = @LDFLAGS@ +LIBOBJS = @LIBOBJS@ +LIBS = @LIBS@ +LIBTOOL = @LIBTOOL@ +LN_S = @LN_S@ +LTLIBOBJS = @LTLIBOBJS@ +MAINT = @MAINT@ +MAINTAINER_MODE_FALSE = @MAINTAINER_MODE_FALSE@ +MAINTAINER_MODE_TRUE = @MAINTAINER_MODE_TRUE@ +MAKEINFO = @MAKEINFO@ +OBJEXT = @OBJEXT@ +PACKAGE = @PACKAGE@ +PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ +PACKAGE_NAME = @PACKAGE_NAME@ +PACKAGE_STRING = @PACKAGE_STRING@ +PACKAGE_TARNAME = @PACKAGE_TARNAME@ +PACKAGE_VERSION = @PACKAGE_VERSION@ +PATH_SEPARATOR = @PATH_SEPARATOR@ +RANLIB = @RANLIB@ +SET_MAKE = @SET_MAKE@ +SHELL = @SHELL@ +STRIP = @STRIP@ +VERSION = @VERSION@ +ac_ct_AR = @ac_ct_AR@ +ac_ct_CC = @ac_ct_CC@ +ac_ct_CXX = @ac_ct_CXX@ +ac_ct_F77 = @ac_ct_F77@ +ac_ct_RANLIB = @ac_ct_RANLIB@ +ac_ct_STRIP = @ac_ct_STRIP@ +am__fastdepCC_FALSE = @am__fastdepCC_FALSE@ +am__fastdepCC_TRUE = @am__fastdepCC_TRUE@ +am__fastdepCXX_FALSE = @am__fastdepCXX_FALSE@ +am__fastdepCXX_TRUE = @am__fastdepCXX_TRUE@ +am__include = @am__include@ +am__leading_dot = @am__leading_dot@ +am__quote = @am__quote@ +am__tar = @am__tar@ +am__untar = @am__untar@ +bindir = @bindir@ +build = @build@ +build_alias = @build_alias@ +build_cpu = @build_cpu@ +build_os = @build_os@ +build_vendor = @build_vendor@ +datadir = @datadir@ +exec_prefix = @exec_prefix@ +extra_incl = @extra_incl@ +host = @host@ +host_alias = @host_alias@ +host_cpu = @host_cpu@ +host_os = @host_os@ +host_vendor = @host_vendor@ +includedir = @includedir@ +infodir = @infodir@ +install_sh = @install_sh@ +libdir = ${exec_prefix}/lib/snort_dynamicpreprocessor +libexecdir = @libexecdir@ +localstatedir = @localstatedir@ +mandir = @mandir@ +mkdir_p = @mkdir_p@ +oldincludedir = @oldincludedir@ +prefix = @prefix@ +program_transform_name = @program_transform_name@ +sbindir = @sbindir@ +sharedstatedir = @sharedstatedir@ +sysconfdir = @sysconfdir@ +target_alias = @target_alias@ +AUTOMAKE_OPTIONS = foreign no-dependencies +lib_LTLIBRARIES = libsf_pehunter_preproc.la +libsf_pehunter_preproc_la_LDFLAGS = -module +BUILT_SOURCES = \ +sf_dynamic_preproc_lib.c + +nodist_libsf_pehunter_preproc_la_SOURCES = \ +sf_dynamic_preproc_lib.c + +libsf_pehunter_preproc_la_SOURCES = \ +spp_pehunter.c spp_pehunter.h \ +pehunter.c pehunter.h \ +md5.c md5.h \ +sf_preproc_info.h + +EXTRA_DIST = \ +sf_pehunter.dsp + +all: $(BUILT_SOURCES) + $(MAKE) $(AM_MAKEFLAGS) all-am + +.SUFFIXES: +.SUFFIXES: .c .lo .o .obj +$(srcdir)/Makefile.in: @MAINTAINER_MODE_TRUE@ $(srcdir)/Makefile.am $(am__configure_deps) + @for dep in $?; do \ + case '$(am__configure_deps)' in \ + *$$dep*) \ + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh \ + && exit 0; \ + exit 1;; \ + esac; \ + done; \ + echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign src/dynamic-preprocessors/pehunter/Makefile'; \ + cd $(top_srcdir) && \ + $(AUTOMAKE) --foreign src/dynamic-preprocessors/pehunter/Makefile +.PRECIOUS: Makefile +Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status + @case '$?' in \ + *config.status*) \ + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ + *) \ + echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ + cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ + esac; + +$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh + +$(top_srcdir)/configure: @MAINTAINER_MODE_TRUE@ $(am__configure_deps) + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh +$(ACLOCAL_M4): @MAINTAINER_MODE_TRUE@ $(am__aclocal_m4_deps) + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh +install-libLTLIBRARIES: $(lib_LTLIBRARIES) + @$(NORMAL_INSTALL) + test -z "$(libdir)" || $(mkdir_p) "$(DESTDIR)$(libdir)" + @list='$(lib_LTLIBRARIES)'; for p in $$list; do \ + if test -f $$p; then \ + f=$(am__strip_dir) \ + echo " $(LIBTOOL) --mode=install $(libLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(libdir)/$$f'"; \ + $(LIBTOOL) --mode=install $(libLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(libdir)/$$f"; \ + else :; fi; \ + done + +uninstall-libLTLIBRARIES: + @$(NORMAL_UNINSTALL) + @set -x; list='$(lib_LTLIBRARIES)'; for p in $$list; do \ + p=$(am__strip_dir) \ + echo " $(LIBTOOL) --mode=uninstall rm -f '$(DESTDIR)$(libdir)/$$p'"; \ + $(LIBTOOL) --mode=uninstall rm -f "$(DESTDIR)$(libdir)/$$p"; \ + done + +clean-libLTLIBRARIES: + -test -z "$(lib_LTLIBRARIES)" || rm -f $(lib_LTLIBRARIES) + @list='$(lib_LTLIBRARIES)'; for p in $$list; do \ + dir="`echo $$p | sed -e 's|/[^/]*$$||'`"; \ + test "$$dir" != "$$p" || dir=.; \ + echo "rm -f \"$${dir}/so_locations\""; \ + rm -f "$${dir}/so_locations"; \ + done +libsf_pehunter_preproc.la: $(libsf_pehunter_preproc_la_OBJECTS) $(libsf_pehunter_preproc_la_DEPENDENCIES) + $(LINK) -rpath $(libdir) $(libsf_pehunter_preproc_la_LDFLAGS) $(libsf_pehunter_preproc_la_OBJECTS) $(libsf_pehunter_preproc_la_LIBADD) $(LIBS) + +mostlyclean-compile: + -rm -f *.$(OBJEXT) + +distclean-compile: + -rm -f *.tab.c + +.c.o: + $(COMPILE) -c $< + +.c.obj: + $(COMPILE) -c `$(CYGPATH_W) '$<'` + +.c.lo: + $(LTCOMPILE) -c -o $@ $< + +mostlyclean-libtool: + -rm -f *.lo + +clean-libtool: + -rm -rf .libs _libs + +distclean-libtool: + -rm -f libtool +uninstall-info-am: + +ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES) + list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \ + unique=`for i in $$list; do \ + if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ + done | \ + $(AWK) ' { files[$$0] = 1; } \ + END { for (i in files) print i; }'`; \ + mkid -fID $$unique +tags: TAGS + +TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \ + $(TAGS_FILES) $(LISP) + tags=; \ + here=`pwd`; \ + list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \ + unique=`for i in $$list; do \ + if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ + done | \ + $(AWK) ' { files[$$0] = 1; } \ + END { for (i in files) print i; }'`; \ + if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \ + test -n "$$unique" || unique=$$empty_fix; \ + $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ + $$tags $$unique; \ + fi +ctags: CTAGS +CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \ + $(TAGS_FILES) $(LISP) + tags=; \ + here=`pwd`; \ + list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \ + unique=`for i in $$list; do \ + if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ + done | \ + $(AWK) ' { files[$$0] = 1; } \ + END { for (i in files) print i; }'`; \ + test -z "$(CTAGS_ARGS)$$tags$$unique" \ + || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \ + $$tags $$unique + +GTAGS: + here=`$(am__cd) $(top_builddir) && pwd` \ + && cd $(top_srcdir) \ + && gtags -i $(GTAGS_ARGS) $$here + +distclean-tags: + -rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags + +distdir: $(DISTFILES) + @srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; \ + topsrcdirstrip=`echo "$(top_srcdir)" | sed 's|.|.|g'`; \ + list='$(DISTFILES)'; for file in $$list; do \ + case $$file in \ + $(srcdir)/*) file=`echo "$$file" | sed "s|^$$srcdirstrip/||"`;; \ + $(top_srcdir)/*) file=`echo "$$file" | sed "s|^$$topsrcdirstrip/|$(top_builddir)/|"`;; \ + esac; \ + if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ + dir=`echo "$$file" | sed -e 's,/[^/]*$$,,'`; \ + if test "$$dir" != "$$file" && test "$$dir" != "."; then \ + dir="/$$dir"; \ + $(mkdir_p) "$(distdir)$$dir"; \ + else \ + dir=''; \ + fi; \ + if test -d $$d/$$file; then \ + if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ + cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \ + fi; \ + cp -pR $$d/$$file $(distdir)$$dir || exit 1; \ + else \ + test -f $(distdir)/$$file \ + || cp -p $$d/$$file $(distdir)/$$file \ + || exit 1; \ + fi; \ + done +check-am: all-am +check: $(BUILT_SOURCES) + $(MAKE) $(AM_MAKEFLAGS) check-am +all-am: Makefile $(LTLIBRARIES) all-local +installdirs: + for dir in "$(DESTDIR)$(libdir)"; do \ + test -z "$$dir" || $(mkdir_p) "$$dir"; \ + done +install: $(BUILT_SOURCES) + $(MAKE) $(AM_MAKEFLAGS) install-am +install-exec: install-exec-am +install-data: install-data-am +uninstall: uninstall-am + +install-am: all-am + @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am + +installcheck: installcheck-am +install-strip: + $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ + install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ + `test -z '$(STRIP)' || \ + echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install +mostlyclean-generic: + +clean-generic: + +distclean-generic: + -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) + +maintainer-clean-generic: + @echo "This command is intended for maintainers to use" + @echo "it deletes files that may require special tools to rebuild." + -test -z "$(BUILT_SOURCES)" || rm -f $(BUILT_SOURCES) +clean: clean-am + +clean-am: clean-generic clean-libLTLIBRARIES clean-libtool clean-local \ + mostlyclean-am + +distclean: distclean-am + -rm -f Makefile +distclean-am: clean-am distclean-compile distclean-generic \ + distclean-libtool distclean-tags + +dvi: dvi-am + +dvi-am: + +html: html-am + +info: info-am + +info-am: + +install-data-am: + +install-exec-am: install-libLTLIBRARIES + +install-info: install-info-am + +install-man: + +installcheck-am: + +maintainer-clean: maintainer-clean-am + -rm -f Makefile +maintainer-clean-am: distclean-am maintainer-clean-generic + +mostlyclean: mostlyclean-am + +mostlyclean-am: mostlyclean-compile mostlyclean-generic \ + mostlyclean-libtool + +pdf: pdf-am + +pdf-am: + +ps: ps-am + +ps-am: + +uninstall-am: uninstall-info-am uninstall-libLTLIBRARIES + +.PHONY: CTAGS GTAGS all all-am all-local check check-am clean \ + clean-generic clean-libLTLIBRARIES clean-libtool clean-local \ + ctags distclean distclean-compile distclean-generic \ + distclean-libtool distclean-tags distdir dvi dvi-am html \ + html-am info info-am install install-am install-data \ + install-data-am install-exec install-exec-am install-info \ + install-info-am install-libLTLIBRARIES install-man \ + install-strip installcheck installcheck-am installdirs \ + maintainer-clean maintainer-clean-generic mostlyclean \ + mostlyclean-compile mostlyclean-generic mostlyclean-libtool \ + pdf pdf-am ps ps-am tags uninstall uninstall-am \ + uninstall-info-am uninstall-libLTLIBRARIES + + +sf_dynamic_preproc_lib.c: ../include/sf_dynamic_preproc_lib.c + cp $? $@ + +all-local: + $(MAKE) DESTDIR=$(PWD)/../build install-libLTLIBRARIES + +clean-local: + rm -f sf_dynamic_preproc_lib.c +# Tell versions [3.59,3.63) of GNU make to not export all variables. +# Otherwise a system limit (for SysV at least) may be exceeded. +.NOEXPORT: diff -Naur snort-2.8.2.2/src/dynamic-preprocessors/pehunter/md5.c snort-2.8.2.2-pehunter/src/dynamic-preprocessors/pehunter/md5.c --- snort-2.8.2.2/src/dynamic-preprocessors/pehunter/md5.c 1970-01-01 01:00:00.000000000 +0100 +++ snort-2.8.2.2-pehunter/src/dynamic-preprocessors/pehunter/md5.c 2008-06-01 22:31:40.000000000 +0200 @@ -0,0 +1,306 @@ +/* + * md5.c + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + * + * Copyright (C) 2007 Tillmann Werner + */ + +#include +#include +#include + +#include "md5.h" + +/* + * The basic MD5 functions. + * + * F is optimized compared to its RFC 1321 definition just like in Colin + * Plumb's implementation. + */ +#define F(x, y, z) ((z) ^ ((x) & ((y) ^ (z)))) +#define G(x, y, z) ((y) ^ ((z) & ((x) ^ (y)))) +#define H(x, y, z) ((x) ^ (y) ^ (z)) +#define I(x, y, z) ((y) ^ ((x) | ~(z))) + +/* + * The MD5 transformation for all four rounds. + */ +#define STEP(f, a, b, c, d, x, t, s) \ + (a) += f((b), (c), (d)) + (x) + (t); \ + (a) = (((a) << (s)) | (((a) & 0xffffffff) >> (32 - (s)))); \ + (a) += (b); + +/* + * SET reads 4 input bytes in little-endian byte order and stores them + * in a properly aligned word in host byte order. + * + * The check for little-endian architectures which tolerate unaligned + * memory accesses is just an optimization. Nothing will break if it + * doesn't work. + */ +#if defined(__i386__) || defined(__vax__) +#define SET(n) \ + (*(MD5_u32plus *)&ptr[(n) * 4]) +#define GET(n) \ + SET(n) +#else +#define SET(n) \ + (ctx->block[(n)] = \ + (MD5_u32plus)ptr[(n) * 4] | \ + ((MD5_u32plus)ptr[(n) * 4 + 1] << 8) | \ + ((MD5_u32plus)ptr[(n) * 4 + 2] << 16) | \ + ((MD5_u32plus)ptr[(n) * 4 + 3] << 24)) +#define GET(n) \ + (ctx->block[(n)]) +#endif + +/* + * This processes one or more 64-byte data blocks, but does NOT update + * the bit counters. There're no alignment requirements. + */ +static void *body(MD5_CTX *ctx, void *data, unsigned long size) +{ + unsigned char *ptr; + MD5_u32plus a, b, c, d; + MD5_u32plus saved_a, saved_b, saved_c, saved_d; + + ptr = data; + + a = ctx->a; + b = ctx->b; + c = ctx->c; + d = ctx->d; + + do { + saved_a = a; + saved_b = b; + saved_c = c; + saved_d = d; + +/* Round 1 */ + STEP(F, a, b, c, d, SET(0), 0xd76aa478, 7) + STEP(F, d, a, b, c, SET(1), 0xe8c7b756, 12) + STEP(F, c, d, a, b, SET(2), 0x242070db, 17) + STEP(F, b, c, d, a, SET(3), 0xc1bdceee, 22) + STEP(F, a, b, c, d, SET(4), 0xf57c0faf, 7) + STEP(F, d, a, b, c, SET(5), 0x4787c62a, 12) + STEP(F, c, d, a, b, SET(6), 0xa8304613, 17) + STEP(F, b, c, d, a, SET(7), 0xfd469501, 22) + STEP(F, a, b, c, d, SET(8), 0x698098d8, 7) + STEP(F, d, a, b, c, SET(9), 0x8b44f7af, 12) + STEP(F, c, d, a, b, SET(10), 0xffff5bb1, 17) + STEP(F, b, c, d, a, SET(11), 0x895cd7be, 22) + STEP(F, a, b, c, d, SET(12), 0x6b901122, 7) + STEP(F, d, a, b, c, SET(13), 0xfd987193, 12) + STEP(F, c, d, a, b, SET(14), 0xa679438e, 17) + STEP(F, b, c, d, a, SET(15), 0x49b40821, 22) + +/* Round 2 */ + STEP(G, a, b, c, d, GET(1), 0xf61e2562, 5) + STEP(G, d, a, b, c, GET(6), 0xc040b340, 9) + STEP(G, c, d, a, b, GET(11), 0x265e5a51, 14) + STEP(G, b, c, d, a, GET(0), 0xe9b6c7aa, 20) + STEP(G, a, b, c, d, GET(5), 0xd62f105d, 5) + STEP(G, d, a, b, c, GET(10), 0x02441453, 9) + STEP(G, c, d, a, b, GET(15), 0xd8a1e681, 14) + STEP(G, b, c, d, a, GET(4), 0xe7d3fbc8, 20) + STEP(G, a, b, c, d, GET(9), 0x21e1cde6, 5) + STEP(G, d, a, b, c, GET(14), 0xc33707d6, 9) + STEP(G, c, d, a, b, GET(3), 0xf4d50d87, 14) + STEP(G, b, c, d, a, GET(8), 0x455a14ed, 20) + STEP(G, a, b, c, d, GET(13), 0xa9e3e905, 5) + STEP(G, d, a, b, c, GET(2), 0xfcefa3f8, 9) + STEP(G, c, d, a, b, GET(7), 0x676f02d9, 14) + STEP(G, b, c, d, a, GET(12), 0x8d2a4c8a, 20) + +/* Round 3 */ + STEP(H, a, b, c, d, GET(5), 0xfffa3942, 4) + STEP(H, d, a, b, c, GET(8), 0x8771f681, 11) + STEP(H, c, d, a, b, GET(11), 0x6d9d6122, 16) + STEP(H, b, c, d, a, GET(14), 0xfde5380c, 23) + STEP(H, a, b, c, d, GET(1), 0xa4beea44, 4) + STEP(H, d, a, b, c, GET(4), 0x4bdecfa9, 11) + STEP(H, c, d, a, b, GET(7), 0xf6bb4b60, 16) + STEP(H, b, c, d, a, GET(10), 0xbebfbc70, 23) + STEP(H, a, b, c, d, GET(13), 0x289b7ec6, 4) + STEP(H, d, a, b, c, GET(0), 0xeaa127fa, 11) + STEP(H, c, d, a, b, GET(3), 0xd4ef3085, 16) + STEP(H, b, c, d, a, GET(6), 0x04881d05, 23) + STEP(H, a, b, c, d, GET(9), 0xd9d4d039, 4) + STEP(H, d, a, b, c, GET(12), 0xe6db99e5, 11) + STEP(H, c, d, a, b, GET(15), 0x1fa27cf8, 16) + STEP(H, b, c, d, a, GET(2), 0xc4ac5665, 23) + +/* Round 4 */ + STEP(I, a, b, c, d, GET(0), 0xf4292244, 6) + STEP(I, d, a, b, c, GET(7), 0x432aff97, 10) + STEP(I, c, d, a, b, GET(14), 0xab9423a7, 15) + STEP(I, b, c, d, a, GET(5), 0xfc93a039, 21) + STEP(I, a, b, c, d, GET(12), 0x655b59c3, 6) + STEP(I, d, a, b, c, GET(3), 0x8f0ccc92, 10) + STEP(I, c, d, a, b, GET(10), 0xffeff47d, 15) + STEP(I, b, c, d, a, GET(1), 0x85845dd1, 21) + STEP(I, a, b, c, d, GET(8), 0x6fa87e4f, 6) + STEP(I, d, a, b, c, GET(15), 0xfe2ce6e0, 10) + STEP(I, c, d, a, b, GET(6), 0xa3014314, 15) + STEP(I, b, c, d, a, GET(13), 0x4e0811a1, 21) + STEP(I, a, b, c, d, GET(4), 0xf7537e82, 6) + STEP(I, d, a, b, c, GET(11), 0xbd3af235, 10) + STEP(I, c, d, a, b, GET(2), 0x2ad7d2bb, 15) + STEP(I, b, c, d, a, GET(9), 0xeb86d391, 21) + + a += saved_a; + b += saved_b; + c += saved_c; + d += saved_d; + + ptr += 64; + } while (size -= 64); + + ctx->a = a; + ctx->b = b; + ctx->c = c; + ctx->d = d; + + return ptr; +} + +void MD5_Init(MD5_CTX *ctx) +{ + ctx->a = 0x67452301; + ctx->b = 0xefcdab89; + ctx->c = 0x98badcfe; + ctx->d = 0x10325476; + + ctx->lo = 0; + ctx->hi = 0; +} + +void MD5_Update(MD5_CTX *ctx, void *data, unsigned long size) +{ + MD5_u32plus saved_lo; + unsigned long used, free; + + saved_lo = ctx->lo; + if ((ctx->lo = (saved_lo + size) & 0x1fffffff) < saved_lo) + ctx->hi++; + ctx->hi += size >> 29; + + used = saved_lo & 0x3f; + + if (used) { + free = 64 - used; + + if (size < free) { + memcpy(&ctx->buffer[used], data, size); + return; + } + + memcpy(&ctx->buffer[used], data, free); + data = (unsigned char *)data + free; + size -= free; + body(ctx, ctx->buffer, 64); + } + + if (size >= 64) { + data = body(ctx, data, size & ~(unsigned long)0x3f); + size &= 0x3f; + } + + memcpy(ctx->buffer, data, size); +} + +void MD5_Final(unsigned char *result, MD5_CTX *ctx) +{ + unsigned long used, free; + + used = ctx->lo & 0x3f; + + ctx->buffer[used++] = 0x80; + + free = 64 - used; + + if (free < 8) { + memset(&ctx->buffer[used], 0, free); + body(ctx, ctx->buffer, 64); + used = 0; + free = 64; + } + + memset(&ctx->buffer[used], 0, free - 8); + + ctx->lo <<= 3; + ctx->buffer[56] = ctx->lo; + ctx->buffer[57] = ctx->lo >> 8; + ctx->buffer[58] = ctx->lo >> 16; + ctx->buffer[59] = ctx->lo >> 24; + ctx->buffer[60] = ctx->hi; + ctx->buffer[61] = ctx->hi >> 8; + ctx->buffer[62] = ctx->hi >> 16; + ctx->buffer[63] = ctx->hi >> 24; + + body(ctx, ctx->buffer, 64); + + result[0] = ctx->a; + result[1] = ctx->a >> 8; + result[2] = ctx->a >> 16; + result[3] = ctx->a >> 24; + result[4] = ctx->b; + result[5] = ctx->b >> 8; + result[6] = ctx->b >> 16; + result[7] = ctx->b >> 24; + result[8] = ctx->c; + result[9] = ctx->c >> 8; + result[10] = ctx->c >> 16; + result[11] = ctx->c >> 24; + result[12] = ctx->d; + result[13] = ctx->d >> 8; + result[14] = ctx->d >> 16; + result[15] = ctx->d >> 24; + + memset(ctx, 0, sizeof(*ctx)); +} + +char *mem_md5sum(u_char *mempos, u_int32_t size) +{ + unsigned char digest[16]; + MD5_CTX ctx; + char *md5sum, *ptr; + int i, bytes; + + MD5_Init(&ctx); + + /* calculate md5 checksum */ + while (size > 0) { + bytes = (size < 8192) ? size : 8192; + MD5_Update(&ctx, mempos, bytes); + mempos += bytes; + size -= bytes; + } + + MD5_Final(digest, &ctx); + + /* allocate memory for md5sum string */ + if(!(md5sum = (char *) calloc(32 + 1, 1))) return(NULL); + + ptr = md5sum; + for(i = 0; i < 16; i++) { + snprintf(ptr, 4, "%02x", digest[i]); + ptr += 2; + } + + return(md5sum); +} diff -Naur snort-2.8.2.2/src/dynamic-preprocessors/pehunter/md5.h snort-2.8.2.2-pehunter/src/dynamic-preprocessors/pehunter/md5.h --- snort-2.8.2.2/src/dynamic-preprocessors/pehunter/md5.h 1970-01-01 01:00:00.000000000 +0100 +++ snort-2.8.2.2-pehunter/src/dynamic-preprocessors/pehunter/md5.h 2008-06-01 22:31:40.000000000 +0200 @@ -0,0 +1,39 @@ +/* + * md5.h + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + * + * Copyright (C) 2007 Tillmann Werner + */ + +#ifndef __MD5_H +#define __MD5_H + +/* Any 32-bit or wider unsigned integer data type will do */ +typedef unsigned long MD5_u32plus; + +typedef struct { + MD5_u32plus lo, hi; + MD5_u32plus a, b, c, d; + unsigned char buffer[64]; + MD5_u32plus block[16]; +} MD5_CTX; + +extern void MD5_Init(MD5_CTX *ctx); +extern void MD5_Update(MD5_CTX *ctx, void *data, unsigned long size); +extern void MD5_Final(unsigned char *result, MD5_CTX *ctx); +char *mem_md5sum(u_char *mempos, u_int32_t size); + +#endif diff -Naur snort-2.8.2.2/src/dynamic-preprocessors/pehunter/pehunter.c snort-2.8.2.2-pehunter/src/dynamic-preprocessors/pehunter/pehunter.c --- snort-2.8.2.2/src/dynamic-preprocessors/pehunter/pehunter.c 1970-01-01 01:00:00.000000000 +0100 +++ snort-2.8.2.2-pehunter/src/dynamic-preprocessors/pehunter/pehunter.c 2008-06-01 22:31:40.000000000 +0200 @@ -0,0 +1,238 @@ +/* + * pehunter.c + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + * + * Copyright (C) 2007 Tillmann Werner + */ + +#include +#include +#include + +#include "sf_snort_plugin_api.h" +#include "sf_snort_packet.h" +#include "debug.h" + +#include "pehunter.h" +#include "md5.h" + +#include "profiler.h" +#ifdef PERF_PROFILING +PreprocStats pehuntPerfStats; +PreprocStats pehuntDetectPerfStats; +int pehuntDetectCalled = 0; +#endif + + +extern DynamicPreprocessorData _dpd; + +SessionData *_pehunt; + + +static void PEHunter_SessionFree(void * v) +{ + SessionData *sdata = (SessionData *) v; + + if (sdata) + { + if ( sdata->data ) free(sdata->data); + free(sdata); + } + return; +} + + + +SessionData *PEHunter_Setup(SFSnortPacket *p) +{ + SessionData *datap = NULL; + + if (( !p ) || ( !p->stream_session_ptr )) return(NULL); + if ( !_dpd.streamAPI ) + { + DEBUG_WRAP(_dpd.debugMsg(DEBUG_PEHUNTER, "Error: Failed to get Stream API - Stream not enabled?\n");); + return(NULL); + } + + /* Get session pointer */ + if (( datap = _dpd.streamAPI->get_application_data(p->stream_session_ptr, PP_PEHUNTER)) == NULL) + { + if ((datap = (SessionData *) malloc(sizeof(SessionData))) == NULL) + { + _dpd.fatalMsg("%s(%d) => Failed to allocate memory for session data\n"); + return(NULL); + } + + /* Initialize state for first packet */ + bzero(datap, sizeof(SessionData)); + _dpd.streamAPI->set_application_data(p->stream_session_ptr, PP_PEHUNTER, datap, &PEHunter_SessionFree); + } + + return(datap); +} + +/* + * Function: Hunt() + * + * Purpose: Search for PE magic byte sequence in stream, + * locate PE header, extract length and dump extracted PE into a file + * + * Arguments: Snort packet. + * + * Returns: void + * + */ +int Hunt(SFSnortPacket *p) +{ + int retval; + u_int32_t parsedBytes, dosOffset, maxOffset, maxLen, i, parseStart, pos; + IMAGE_DOS_HEADER *dosHeader; + IMAGE_NT_HEADERS32 *peHeader; + IMAGE_SECTION_HEADER *sectHeader; + SessionData *session_data; + const char *dh_sig = "MZ"; + char *filename; + FILE *dumpfile; + PROFILE_VARS; + + dumpfile = NULL; + filename = NULL; + session_data = NULL; + parsedBytes = 0; + maxOffset = 0; + maxLen = 0; + + /* ignore if no data */ + if (( !p->payload ) || ( !p->payload_size )) + { + return(0); + } + + if ( (session_data = PEHunter_Setup(p)) == NULL) + { + /* Could not get/create the session data for this packet. */ + PREPROC_PROFILE_END(pehuntPerfStats); + return(0); + } + + if (session_data->dumped) + { + /* file already extracted */ + return(1); + } + + /* Append payload to session data */ + if ((session_data->data = (u_char *) realloc(session_data->data, session_data->len + p->payload_size)) == NULL) + { + _dpd.fatalMsg("%s(%d) => Failed to allocate memory for session data\n"); + return(0); + } + + parseStart = (session_data->len ? (session_data->len-1) : 0); + memcpy(session_data->data + session_data->len, p->payload, p->payload_size); + session_data->len += p->payload_size; + + if (session_data->match && (session_data->len >= (session_data->matchpos + session_data->filelen))) + { + /* + if (chdir(_pehunterConfig.dumpDir) == -1) + { + _dpd.fatalMsg("%s(): Unable to change into %s: %s\n", __PRETTY_FUNCTION__, _pehunterConfig.dumpDir, strerror(errno)); + } + */ + if ((filename = strdup(_pehunterConfig.dumpDir)) == NULL) + { + _dpd.fatalMsg("%s(): Unable to allocate memory: %s\n", __PRETTY_FUNCTION__, strerror(errno)); + } + if ((filename = realloc(filename, strlen(filename)+34)) == NULL) { + _dpd.fatalMsg("%s(): Unable to allocate memory: %s\n", __PRETTY_FUNCTION__, strerror(errno)); + } + + /* assemble filename */ + bzero(filename+strlen(filename), 34); + strncat(filename, "/", 1); + mem_md5sum(session_data->data+session_data->matchpos, session_data->filelen); + strncat(filename, mem_md5sum(session_data->data+session_data->matchpos, session_data->filelen), 32); + + if ((dumpfile = fopen(filename, "w")) == NULL) + { + _dpd.fatalMsg("%s(): Unable to open dumpfile %s: %s\n", __PRETTY_FUNCTION__, filename, strerror(errno)); + } + if ((retval = fwrite(session_data->data+session_data->matchpos, 1, session_data->filelen, dumpfile)) < session_data->filelen) + { + _dpd.fatalMsg("%s(): Unable to write dumpfile %s (%u bytes written): %s\n", __PRETTY_FUNCTION__, filename, retval, strerror(errno)); + } + if (fclose(dumpfile) == EOF) + { + _dpd.fatalMsg("%s(): Unable to close dumpfile %s: %s\n", __PRETTY_FUNCTION__, filename, strerror(errno)); + } + session_data->dumped = 1; + _dpd.logMsg("PE file extracted: %u bytes dumped to %s.\n", session_data->filelen, filename); + free(filename); + + return(1); + } + + + /* Check for DOS header signature */ + for (dosOffset=parseStart; (dosOffset + strlen(dh_sig)) < session_data->len; dosOffset++) + { + if (memcmp(session_data->data + dosOffset, dh_sig, strlen(dh_sig)) == 0) break; + } + parsedBytes = dosOffset - parseStart; + + /* Spot DOS header */ + if (session_data->len < (sizeof(IMAGE_DOS_HEADER) + parsedBytes)) return(0); + dosHeader = (IMAGE_DOS_HEADER *)(session_data->data + parsedBytes); + if (dosHeader->e_magic != IMAGE_DOS_SIGNATURE) return(0); + pos = parsedBytes; + if (_pehunterConfig.debug) _dpd.logMsg("DOS header found at offset %lu.\n", pos); + + if (session_data->len < (sizeof(IMAGE_NT_HEADERS32) + parsedBytes + dosHeader->e_lfanew)) return(0); + parsedBytes += dosHeader->e_lfanew; + if (_pehunterConfig.debug) _dpd.logMsg("DOS header e_lfanew is %lu, parsedBytes is %lu.\n", dosHeader->e_lfanew, parsedBytes); + + /* image file header */ + if ((session_data->len) < (sizeof(IMAGE_NT_HEADERS32) + parsedBytes)) return(0); + peHeader = (IMAGE_NT_HEADERS32*)(session_data->data + parsedBytes); + if (peHeader->Signature == IMAGE_NT_SIGNATURE) + { + if (_pehunterConfig.debug) _dpd.logMsg("NT header found at offset %lu.\n", parsedBytes); + parsedBytes += sizeof(IMAGE_NT_HEADERS32); + + /* loop through section table */ + for (i=0; iFileHeader.NumberOfSections; i++) { + if (session_data->len < (sizeof(IMAGE_SECTION_HEADER) + parsedBytes)) return(0); + sectHeader = (IMAGE_SECTION_HEADER *)(session_data->data + parsedBytes); + if (_pehunterConfig.debug) _dpd.logMsg("Section header found at offset %lu.\n", parsedBytes); + parsedBytes += sizeof(IMAGE_SECTION_HEADER); + if (_pehunterConfig.debug) _dpd.logMsg("Section %lu (%s): starts at offset %lu (%u bytes)\n", + i, sectHeader->Name, sectHeader->PointerToRawData, sectHeader->SizeOfRawData); + if (maxOffset < sectHeader->PointerToRawData) { + maxOffset = sectHeader->PointerToRawData; + maxLen = sectHeader->SizeOfRawData; + } + } + } + if (maxOffset + maxLen) + { + session_data->match = 1; + session_data->matchpos = pos; + session_data->filelen = maxOffset + maxLen; + } + + return(0); +} diff -Naur snort-2.8.2.2/src/dynamic-preprocessors/pehunter/pehunter.h snort-2.8.2.2-pehunter/src/dynamic-preprocessors/pehunter/pehunter.h --- snort-2.8.2.2/src/dynamic-preprocessors/pehunter/pehunter.h 1970-01-01 01:00:00.000000000 +0100 +++ snort-2.8.2.2-pehunter/src/dynamic-preprocessors/pehunter/pehunter.h 2008-06-01 22:31:40.000000000 +0200 @@ -0,0 +1,152 @@ +/* + * pehunter.h + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + * + * Copyright (C) 2007 Tillmann Werner + */ + +#ifndef __PEHUNTER_H__ +#define __PEHUNTER_H__ + +#include "sf_snort_packet.h" +#include "sf_dynamic_preprocessor.h" + +#include "spp_pehunter.h" + + +/* PE file format stuff below taken from winnt.h */ + +#define IMAGE_DOS_SIGNATURE 0x5A4D // MZ +#define IMAGE_NT_SIGNATURE 0x00004550 // PE00 +#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16 +#define IMAGE_SIZEOF_SHORT_NAME 8 +#define IMAGE_SIZEOF_SECTION_HEADER 40 + +typedef struct _IMAGE_SECTION_HEADER { + char Name[IMAGE_SIZEOF_SHORT_NAME]; + union { + u_int32_t PhysicalAddress; + u_int32_t VirtualSize; + } Misc; + u_int32_t VirtualAddress; + u_int32_t SizeOfRawData; + u_int32_t PointerToRawData; + u_int32_t PointerToRelocations; + u_int32_t PointerToLinenumbers; + u_int16_t NumberOfRelocations; + u_int16_t NumberOfLinenumbers; + u_int32_t Characteristics; +} IMAGE_SECTION_HEADER; + +typedef struct _IMAGE_DATA_DIRECTORY { + u_int32_t VirtualAddress; + u_int32_t Size; +} IMAGE_DATA_DIRECTORY; + +typedef struct _IMAGE_FILE_HEADER { + u_int16_t Machine; + u_int16_t NumberOfSections; + u_int32_t TimeDateStamp; + u_int32_t PointerToSymbolTable; + u_int32_t NumberOfSymbols; + u_int16_t SizeOfOptionalHeader; + u_int16_t Characteristics; +} IMAGE_FILE_HEADER; + +typedef struct _IMAGE_OPTIONAL_HEADER { + + /* Standard fields */ + u_int16_t Magic; + u_int8_t MajorLinkerVersion; + u_int8_t MinorLinkerVersion; + u_int32_t SizeOfCode; + u_int32_t SizeOfInitializedData; + u_int32_t SizeOfUninitializedData; + u_int32_t AddressOfEntryPoint; + u_int32_t BaseOfCode; + u_int32_t BaseOfData; + + /* NT additional fields */ + u_int32_t ImageBase; + u_int32_t SectionAlignment; + u_int32_t FileAlignment; + u_int16_t MajorOperatingSystemVersion; + u_int16_t MinorOperatingSystemVersion; + u_int16_t MajorImageVersion; + u_int16_t MinorImageVersion; + u_int16_t MajorSubsystemVersion; + u_int16_t MinorSubsystemVersion; + u_int32_t Win32VersionValue; + u_int32_t SizeOfImage; + u_int32_t SizeOfHeaders; + u_int32_t CheckSum; + u_int16_t Subsystem; + u_int16_t DllCharacteristics; + u_int32_t SizeOfStackReserve; + u_int32_t SizeOfStackCommit; + u_int32_t SizeOfHeapReserve; + u_int32_t SizeOfHeapCommit; + u_int32_t LoaderFlags; + u_int32_t NumberOfRvaAndSizes; + IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; // 0x60 +} IMAGE_OPTIONAL_HEADER32; + +typedef struct _IMAGE_DOS_HEADER { + u_int16_t e_magic; // 00: MZ Header signature + u_int16_t e_cblp; // 02: Bytes on last page of file + u_int16_t e_cp; // 04: Pages in file + u_int16_t e_crlc; // 06: Relocations + u_int16_t e_cparhdr; // 08: Size of header in paragraphs + u_int16_t e_minalloc; // 0a: Minimum extra paragraphs needed + u_int16_t e_maxalloc; // 0c: Maximum extra paragraphs needed + u_int16_t e_ss; // 0e: Initial (relative) SS value + u_int16_t e_sp; // 10: Initial SP value + u_int16_t e_csum; // 12: Checksum + u_int16_t e_ip; // 14: Initial IP value + u_int16_t e_cs; // 16: Initial (relative) CS value + u_int16_t e_lfarlc; // 18: File address of relocation table + u_int16_t e_ovno; // 1a: Overlay number + u_int16_t e_res[4]; // 1c: Reserved words + u_int16_t e_oemid; // OEM identifier (for e_oeminfo) + u_int16_t e_oeminfo; // 26: OEM information; e_oemid specific + u_int16_t e_res2[10]; // 28: Reserved words + u_int32_t e_lfanew; // 3c: Offset to extended header +} IMAGE_DOS_HEADER; + +typedef struct _IMAGE_NT_HEADERS { + u_int32_t Signature; // "PE00" + IMAGE_FILE_HEADER FileHeader; // 0x04 + IMAGE_OPTIONAL_HEADER32 OptionalHeader; // 0x18 +} IMAGE_NT_HEADERS32; + +/* end of PE file format stuff */ + + +typedef struct _SessionData { + u_int8_t match; + u_int8_t dumped; + u_int32_t len; + u_int32_t matchpos; + u_int32_t filelen; + u_char *data; + IMAGE_DOS_HEADER *dosHeader; + IMAGE_NT_HEADERS32 *peHeader; + IMAGE_SECTION_HEADER *sectHeader; +} SessionData; + +int Hunt(SFSnortPacket *p); + +#endif /* __PEHUNTER_H__ */ diff -Naur snort-2.8.2.2/src/dynamic-preprocessors/pehunter/README snort-2.8.2.2-pehunter/src/dynamic-preprocessors/pehunter/README --- snort-2.8.2.2/src/dynamic-preprocessors/pehunter/README 1970-01-01 01:00:00.000000000 +0100 +++ snort-2.8.2.2-pehunter/src/dynamic-preprocessors/pehunter/README 2008-06-01 22:31:40.000000000 +0200 @@ -0,0 +1,50 @@ +PE Hunter is a plugin for snort (aka dynamic preprocessor) for extracting +Windows executables (files in PE format) from the network stream. + +It first spots a PE header and then uses a simple heuristik to calculate the +file length. Starting at the header offset in a stream, the resulting number of +bytes is then dumped to a file. + +This technique does not work for some specially crafted binaries, e.g., self- +extracting archives or programs with additional data after the end of the last +section since there is no way to passively identify such data in a stream. + + +Compiling and Installation +-------------------------- + +Copy the pehunter source directory to src/dynamic-preprocessors in the snort +source tree. You have to add a line like + + #define PP_PEHUNTER 28 + +to src/preprocids.h. Then modify the autoconf stuff to include the module in +the build process. The usual configure [opts] && make && make install places +installs snort with PEHunter preprocessor. + +Use snort in inline mode (configure with --enable-inline on Linux) to make sure +that no packet gets missed. This quarantees full and fault-free stream +reassembly and is the recommended mode for PEHunter. + + +Configuration +------------- + +Files are stored as their md5 checksum of the corresponding data in a +configurable location. Snort must be configured to use PE Hunter. Please include +the following lines in your snort.conf: + + + # make sure to load the stream4 preprocessor first + dynamicpreprocessor file /location/of/libsf_smtp_preproc.so + + # Configure PE Hunter module + # -------------------------- + preprocessor pehunter: dump_dir /var/log/snort/binaries + + +Add a 'debug' option to the above line to produce verbose logging. + + +PEHunter is licensed under the GNU General Public License version 2. +Copyright (C) 2007 Tillmann Werner diff -Naur snort-2.8.2.2/src/dynamic-preprocessors/pehunter/sf_preproc_info.h snort-2.8.2.2-pehunter/src/dynamic-preprocessors/pehunter/sf_preproc_info.h --- snort-2.8.2.2/src/dynamic-preprocessors/pehunter/sf_preproc_info.h 1970-01-01 01:00:00.000000000 +0100 +++ snort-2.8.2.2-pehunter/src/dynamic-preprocessors/pehunter/sf_preproc_info.h 2008-06-01 22:31:40.000000000 +0200 @@ -0,0 +1,29 @@ +/* Copyright (C) 2005 Sourcefire +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License as published by +** the Free Software Foundation; either version 2 of the License, or +** (at your option) any later version. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. +*/ + +#ifndef SF_PREPROC_INFO_H +#define SF_PREPROC_INFO_H + +#define MAJOR_VERSION 1 +#define MINOR_VERSION 0 +#define BUILD_VERSION 1 +#define PREPROC_NAME "SF_PEHUNTER" + +#define DYNAMIC_PREPROC_SETUP SetupPEHunter +extern void SetupPEHunter(); + +#endif /* SF_PREPROC_INFO_H */ diff -Naur snort-2.8.2.2/src/dynamic-preprocessors/pehunter/spp_pehunter.c snort-2.8.2.2-pehunter/src/dynamic-preprocessors/pehunter/spp_pehunter.c --- snort-2.8.2.2/src/dynamic-preprocessors/pehunter/spp_pehunter.c 1970-01-01 01:00:00.000000000 +0100 +++ snort-2.8.2.2-pehunter/src/dynamic-preprocessors/pehunter/spp_pehunter.c 2008-06-01 22:31:40.000000000 +0200 @@ -0,0 +1,311 @@ +/* + * spp_pehunter.c + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + * + * Copyright (C) 2007 Tillmann Werner + * + * Description: + * + */ + +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif /* HAVE_CONFIG_H */ + +#include +#include + +#include "sf_snort_packet.h" +#include "sf_dynamic_preprocessor.h" +#include "sf_snort_plugin_api.h" +#include "preprocids.h" + +#include "spp_pehunter.h" +#include "pehunter.h" + +#include "profiler.h" +#ifdef PERF_PROFILING +PreprocStats pehuntPerfStats; +PreprocStats pehuntDetectPerfStats; +int pehuntDetectCalled = 0; +#endif + +#define CONF_SEPARATORS " \t\n\r" + + +extern DynamicPreprocessorData _dpd; + +static void PEHunterInit(u_char *); +void PEHunter_ParseArgs(u_char *args); +static void PrintPEHunterConfig(void); +static void FreePEHunterConfig(void); +static void HuntPE(void *, void *context); +static void PEHunterCleanExitFunction(int, void *); +static void PEHunterRestartFunction(int, void *); +static void HuntPE(void *pkt, void *context); + + +/* + * Function: SetupPEHunter() + * + * Purpose: Registers the preprocessor keyword and initialization + * function into the preprocessor list. This is the function that + * gets called from InitPreprocessors() in plugbase.c. + * + * Arguments: None. + * + * Returns: void function + * + */ +void SetupPEHunter() +{ + /* link the preprocessor keyword to the init function in + * the preproc list */ + _dpd.registerPreproc("pehunter", PEHunterInit); +} + + +/* + * Function: PEHunterInit(u_char *) + * + * Purpose: Calls the argument parsing function, performs final setup on data + * structs, links the preproc function into the function list. + * + * Arguments: args => ptr to argument string + * + * Returns: void function + * + */ +static void PEHunterInit(u_char *args) +{ + static int bFirstConfig = 1; + + + if(!_dpd.streamAPI) + { + _dpd.fatalMsg("PEHunterInit(): The Stream preprocessor must be enabled.\n"); + } + + + /* Parse the argument list from the rules file */ + PEHunter_ParseArgs(args); + + + /* Perform any other initialization functions that are required here */ +// PEHunter_Init(); + + /* Put the preprocessor function into the function list */ + if ( bFirstConfig ) + { + _dpd.addPreproc(HuntPE, PRIORITY_APPLICATION, PP_PEHUNTER); + _dpd.addPreprocExit(PEHunterCleanExitFunction, NULL, PRIORITY_LAST, PP_PEHUNTER); + _dpd.addPreprocRestart(PEHunterRestartFunction, NULL, PRIORITY_LAST, PP_PEHUNTER); + bFirstConfig = 0; + +#ifdef PERF_PROFILING + _dpd.addPreprocProfileFunc("pehunter", (void*)&pehuntPerfStats, 0, _dpd.totalPerfStats); +#endif + } +} + + +/* + * Function: PEHunter_ParseArgs(char *) + * + * Purpose: Process the preprocessor arguments from the rules file and + * initialize the preprocessor's data struct. This function doesn't + * have to exist if it makes sense to parse the args in the init + * function. + * + * Arguments: args => argument list + * + * Returns: void function + * + */ +void PEHunter_ParseArgs(u_char *args) +{ + char *arg; + char *value; + + bzero(&_pehunterConfig, sizeof(PEHunterConfig)); + + if ((!_dpd.streamAPI) || (_dpd.streamAPI->version < STREAM_API_VERSION4)) + _dpd.fatalMsg("%s(): Streaming & reassembly must be enabled\n", __PRETTY_FUNCTION__); + + if ( args == NULL ) + { + return; + } + + /* loop through args */ + arg = strtok((char *)args, CONF_SEPARATORS); + while (arg != NULL) + { + if ( !strcasecmp("dump_dir", arg) ) { + value = strtok(NULL, CONF_SEPARATORS); + if ( value == NULL ) return; + if ((_pehunterConfig.dumpDir = strdup(value)) == NULL) { + _dpd.fatalMsg("%s(): Unable to allocate memory: %s\n", __PRETTY_FUNCTION__, strerror(errno)); + } + } else if ( !strcasecmp("debug", arg) ) { + _pehunterConfig.debug = 1; + } else { + _dpd.fatalMsg("%s(%d) => Unknown PEHunter configuration option %s\n", + *(_dpd.config_file), *(_dpd.config_line), arg); + } + /* Get next token */ + arg = strtok(NULL, CONF_SEPARATORS); + } + + PrintPEHunterConfig(); + + if (_pehunterConfig.dumpDir == NULL) + { + _dpd.fatalMsg("%s(): No dump directory given. Check your config file.\n", __PRETTY_FUNCTION__); + } +} + + +/* + * Function: PrintPEHunterConfig(void) + * + * Purpose: Does what it's named + * + * Arguments: none + * + * Returns: void + * + */ +static void PrintPEHunterConfig(void) +{ + /* print configuration */ + _dpd.logMsg("PEHunter config:\n"); + _dpd.logMsg(" Dump Directory:\t %s\n", _pehunterConfig.dumpDir); + _dpd.logMsg(" Debug:\t\t %s\n", _pehunterConfig.debug ? "yes" : "no"); + _dpd.logMsg("\n"); + + return; +} + + +/* + * Function: FreePEHunterConfig(void) + * + * Purpose: Frees allocated memory for config options + * + * Arguments: none + * + * Returns: void + * + */ +static void FreePEHunterConfig(void) +{ + free(_pehunterConfig.dumpDir); + return; +} + + +/* + * Function: HuntPE(Packet *) + * + * Purpose: Perform the preprocessor's intended function. This can be + * simple (statistics collection) or complex (IP defragmentation) + * as you like. Try not to destroy the performance of the whole + * system by trying to do too much.... + * + * Arguments: p => pointer to the current packet data struct + * + * Returns: void function + * + */ +static void HuntPE(void *initial_pkt, void *context) +{ + SFSnortPacket *p = (SFSnortPacket *)initial_pkt; + PROFILE_VARS; + + /* Make sure this preprocessor should run. */ + if (( !p ) || + ( !p->payload ) || + ( !p->payload_size ) || + /* check if we're waiting on stream reassembly */ + ( p->flags & FLAG_STREAM_INSERT)) + { + return; + } + + + PREPROC_PROFILE_START(pehuntPerfStats); + + if (_pehunterConfig.debug) _dpd.logMsg("PEHunter: Processing packet with %u bytes.\n", p->payload_size); + Hunt(p); + + PREPROC_PROFILE_END(pehuntPerfStats); +#ifdef PERF_PROFILING + if (pehuntDetectCalled) + { + pehuntPerfStats.ticks -= pehuntDetectPerfStats.ticks; + /* And Reset ticks to 0 */ + pehuntDetectPerfStats.ticks = 0; + pehuntDetectCalled = 0; + } +#endif + + /* + * if you need to issue an alert from your preprocessor, check out + * event_wrapper.h, there are some useful helper functions there + */ +} + + +/* + * Function: PEHunterCleanExitFunction(int, void *) + * + * Purpose: This function gets called when Snort is exiting, if there's + * any cleanup that needs to be performed (e.g. closing files) + * it should be done here. + * + * Arguments: signal => the code of the signal that was issued to Snort + * data => any arguments or data structs linked to this + * function when it was registered, may be + * needed to properly exit + * + * Returns: void function + */ +static void PEHunterCleanExitFunction(int signal, void *data) +{ + FreePEHunterConfig(); +// PEHunter_Free(); +} + + +/* + * Function: PEHunterRestartFunction(int, void *) + * + * Purpose: This function gets called when Snort is restarting on a SIGHUP, + * if there's any initialization or cleanup that needs to happen + * it should be done here. + * + * Arguments: signal => the code of the signal that was issued to Snort + * data => any arguments or data structs linked to this + * functioin when it was registered, may be + * needed to properly exit + * + * Returns: void function + */ +static void PEHunterRestartFunction(int signal, void *foo) +{ + /* restart code goes here */ +} diff -Naur snort-2.8.2.2/src/dynamic-preprocessors/pehunter/spp_pehunter.h snort-2.8.2.2-pehunter/src/dynamic-preprocessors/pehunter/spp_pehunter.h --- snort-2.8.2.2/src/dynamic-preprocessors/pehunter/spp_pehunter.h 1970-01-01 01:00:00.000000000 +0100 +++ snort-2.8.2.2-pehunter/src/dynamic-preprocessors/pehunter/spp_pehunter.h 2008-06-01 22:31:40.000000000 +0200 @@ -0,0 +1,33 @@ +/* + * spp_pehunter.h + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + * + * Copyright (C) 2007 Tillmann Werner + */ + +#ifndef __SPP_PEHUNTER_H__ +#define __SPP_PEHUNTER_H__ + +typedef struct _PEHunterConfig { + u_char debug; + char *dumpDir; +} PEHunterConfig; + +PEHunterConfig _pehunterConfig; + +void SetupPEHunter(); + +#endif diff -Naur snort-2.8.2.2/src/preprocids.h snort-2.8.2.2-pehunter/src/preprocids.h --- snort-2.8.2.2/src/preprocids.h 2008-03-04 20:53:21.000000000 +0100 +++ snort-2.8.2.2-pehunter/src/preprocids.h 2008-06-01 22:32:41.000000000 +0200 @@ -66,6 +66,7 @@ #define PP_SKYPE 28 #define PP_SSL 29 #define PP_RULES 30 +#define PP_PEHUNTER 31 #define PRIORITY_FIRST 0x0 #define PRIORITY_NETWORK 0x10