[Forensics-changes] [yara] 13/407: Document ELF module
Hilko Bengen
bengen at moszumanska.debian.org
Sat Jul 1 10:27:58 UTC 2017
This is an automated email from the git hooks/post-receive script.
bengen pushed a commit to annotated tag v3.3.0
in repository yara.
commit ab30621a7b9f25e27cbac8bbe58f5cac56299fa3
Author: Victor Manuel Alvarez <vmalvarez at virustotal.com>
Date: Thu Aug 28 14:56:19 2014 +0200
Document ELF module
---
docs/modules.rst | 11 +-
docs/modules/{cuckoo => cuckoo.rst} | 4 +-
docs/modules/elf.rst | 193 ++++++++++++++++++++++++++++++++++++
docs/modules/{magic => magic.rst} | 0
docs/modules/{pe => pe.rst} | 4 +-
5 files changed, 205 insertions(+), 7 deletions(-)
diff --git a/docs/modules.rst b/docs/modules.rst
index 17b4f92..faf62a8 100644
--- a/docs/modules.rst
+++ b/docs/modules.rst
@@ -8,9 +8,14 @@ more complex conditions. Here you'll find described some modules officially
distributed with YARA, but you can also learn how to write your own modules in
the :ref:`writing-modules` section.
-.. include:: modules/pe
-.. include:: modules/cuckoo
-.. include:: modules/magic
+
+.. toctree::
+ :maxdepth: 3
+
+ modules/pe
+ modules/elf
+ modules/cuckoo
+ modules/magic
diff --git a/docs/modules/cuckoo b/docs/modules/cuckoo.rst
similarity index 98%
rename from docs/modules/cuckoo
rename to docs/modules/cuckoo.rst
index 1cb5423..ceee712 100644
--- a/docs/modules/cuckoo
+++ b/docs/modules/cuckoo.rst
@@ -84,8 +84,8 @@ If you are using ``yara-python`` then you must pass the behavior report in the
rules.match(pe_file, modules_data={'cuckoo': bytes(report_data)})
-Cuckoo module reference
------------------------
+Reference
+---------
.. default-domain:: c
diff --git a/docs/modules/elf.rst b/docs/modules/elf.rst
new file mode 100644
index 0000000..208ee81
--- /dev/null
+++ b/docs/modules/elf.rst
@@ -0,0 +1,193 @@
+
+.. _elf-module:
+
+##########
+ELF module
+##########
+
+The ELF module is very similar to the :ref:`pe-module`, but for ELF files. This
+module exposes most of the fields present in a ELF header. Let's see some
+examples::
+
+ import "elf"
+
+ rule single_section
+ {
+ condition:
+ elf.number_of_sections == 1
+ }
+
+ rule elf_64
+ {
+ condition:
+ elf.machine == elf.EM_X86_64
+ }
+
+Reference
+---------
+
+.. c:type:: type
+
+ Integer with one of the following values:
+
+ .. c:type:: ET_NONE
+
+ No file type.
+
+ .. c:type:: ET_REL
+
+ Relocatable file.
+
+ .. c:type:: ET_EXEC
+
+ Executable file.
+
+ .. c:type:: ET_DYN
+
+ Shared object file.
+
+ .. c:type:: ET_CORE
+
+ Core file.
+
+ *Example: elf.type == elf.ET_EXEC*
+
+.. c:type:: machine
+
+ Integer with one of the following values:
+
+ .. c:type:: EM_M32
+ .. c:type:: EM_SPARC
+ .. c:type:: EM_386
+ .. c:type:: EM_68K
+ .. c:type:: EM_88K
+ .. c:type:: EM_860
+ .. c:type:: EM_MIPS
+ .. c:type:: EM_ARM"
+ .. c:type:: EM_MIPS
+ .. c:type:: EM_X86_64
+
+ *Example: elf.machine == elf.EM_X86_64*
+
+.. c:type:: entry_point
+
+ Entry point raw offset or virtual address depending if YARA is scanning a
+ file or process memory respectively. This is equivalent to the deprecated
+ ``entrypoint`` keyword.
+
+.. c:type:: number_of_sections
+
+ Number of sections in the ELF file.
+
+.. c:type:: sections
+
+ An zero-based array of section objects, one for each section the ELF has.
+ Individual sections can be accessed by using the [] operator. Each section
+ object has the following attributes:
+
+ .. c:member:: name
+
+ Section's name.
+
+ *Example: elf.section[3].name == ".bss"*
+
+ .. c:member:: size
+
+ Section's size in bytes. Unless the section type is SHT_NOBITS, the
+ section occupies sh_size bytes in the file. A section of
+ :c:type:`SHT_NOBITS` may have a non-zero size, but it occupies no space
+ in the file.
+
+ .. c:member:: offset
+
+ Offset from the beginning of the file to the first byte in the section.
+ One section type, :c:type:`SHT_NOBITS` described below, occupies no
+ space in the file, and its :c:member:`offset` member locates the
+ conceptual placement in the file.
+
+ .. c:member:: type
+
+ Integer with one of the following value:
+
+ .. c:type:: SHT_NULL
+
+ This value marks the section as inactive; it does not have
+ an associated section. Other members of the section header have
+ undefined values.
+
+ .. c:type:: SHT_PROGBITS
+
+ The section holds information defined by the program, whose format
+ and meaning are determined solely by the program.
+
+ .. c:type:: SHT_SYMTAB
+
+ The section hold a symbol table.
+
+ .. c:type:: SHT_STRTAB
+
+ The section holds a string table. An object file may have multiple
+ string table sections.
+
+ .. c:type:: SHT_RELA
+
+ The section holds relocation entries.
+
+ .. c:type:: SHT_HASH
+
+ The section holds a symbol hash table.
+
+ .. c:type:: SHT_DYNAMIC
+
+ The section holds information for dynamic linking.
+
+ .. c:type:: SHT_NOTE
+
+ The section holds information that marks the file in some way.
+
+ .. c:type:: SHT_NOBITS
+
+ A section of this type occupies no space in the file but otherwise resembles :c:type:`SHT_PROGBITS`.
+
+ .. c:type:: SHT_REL
+
+ The section holds relocation entries.
+
+ .. c:type:: SHT_SHLIB
+
+ This section type is reserved but has unspecified semantics.
+
+ .. c:type:: SHT_DYNSYM
+
+ This section holds dynamic linking symbols.
+
+ .. c:member:: flags
+
+ Integer with sections's flags as defined below:
+
+ .. c:type:: SHF_WRITE
+
+ The section contains data that should be writable during process
+ execution.
+
+ .. c:type:: SHF_ALLOC
+
+ The section occupies memory during process execution. Some control sections do not reside in the memory image of an object file; this attribute is off for those sections.
+
+ .. c:type:: SHF_EXECINSTR
+
+ The section contains executable machine instructions.
+
+ *Example: elf.section[2].flags & elf.SHF_WRITE*
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/docs/modules/magic b/docs/modules/magic.rst
similarity index 100%
rename from docs/modules/magic
rename to docs/modules/magic.rst
diff --git a/docs/modules/pe b/docs/modules/pe.rst
similarity index 99%
rename from docs/modules/pe
rename to docs/modules/pe.rst
index 5dbfc85..99a8060 100644
--- a/docs/modules/pe
+++ b/docs/modules/pe.rst
@@ -30,8 +30,8 @@ write more expressive and targeted rules. Let's see some examples::
pe.characteristics & pe.DLL
}
-PE module reference
--------------------
+Reference
+---------
.. c:type:: machine
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/forensics/yara.git
More information about the forensics-changes
mailing list