[Forensics-changes] [yara] 69/407: Switch from using OpenSSL to stand-alone MD5.
Hilko Bengen
bengen at moszumanska.debian.org
Sat Jul 1 10:28:11 UTC 2017
This is an automated email from the git hooks/post-receive script.
bengen pushed a commit to annotated tag v3.3.0
in repository yara.
commit 362c6677ff926f3e33f9732203c8eaa9013d12f1
Author: Wesley Shields <wxs at atarininja.org>
Date: Thu Sep 25 16:24:56 2014 -0400
Switch from using OpenSSL to stand-alone MD5.
The MD5 implementation was taken from:
https://github.com/B-Con/crypto-algorithms
It is in the public domain. Only changes were to rename duplicate type
definitions.
---
Makefile.am | 2 +-
libyara/Makefile.am | 5 +-
libyara/include/yara/md5.h | 34 ++++++++
libyara/md5.c | 189 +++++++++++++++++++++++++++++++++++++++++++++
libyara/modules/pe.c | 22 +++---
5 files changed, 237 insertions(+), 15 deletions(-)
diff --git a/Makefile.am b/Makefile.am
index b525ae0..7b5447d 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -1,4 +1,4 @@
-AM_CFLAGS=-O3 -Wall -I$(srcdir)/libyara/include -lcrypto $(PTHREAD_CFLAGS)
+AM_CFLAGS=-O3 -Wall -I$(srcdir)/libyara/include $(PTHREAD_CFLAGS)
# Build the library in the hand subdirectory first.
SUBDIRS = libyara
diff --git a/libyara/Makefile.am b/libyara/Makefile.am
index eced228..3571b64 100644
--- a/libyara/Makefile.am
+++ b/libyara/Makefile.am
@@ -45,7 +45,8 @@ yarainclude_HEADERS = \
include/yara/modules.h \
include/yara/object.h \
include/yara/strutils.h \
- include/yara/libyara.h
+ include/yara/libyara.h \
+ include/yara/md5.h
lib_LTLIBRARIES = libyara.la
@@ -71,6 +72,8 @@ libyara_la_SOURCES = \
lexer.h \
lexer.l \
libyara.c \
+ md5.c \
+ md5.h \
mem.c \
mem.h \
modules.c \
diff --git a/libyara/include/yara/md5.h b/libyara/include/yara/md5.h
new file mode 100644
index 0000000..f92d251
--- /dev/null
+++ b/libyara/include/yara/md5.h
@@ -0,0 +1,34 @@
+/*********************************************************************
+* Filename: md5.h
+* Author: Brad Conte (brad AT bradconte.com)
+* Copyright:
+* Disclaimer: This code is presented "as is" without any guarantees.
+* Details: Defines the API for the corresponding MD5 implementation.
+*********************************************************************/
+
+#ifndef MD5_H
+#define MD5_H
+
+/*************************** HEADER FILES ***************************/
+#include <stddef.h>
+
+/****************************** MACROS ******************************/
+#define MD5_BLOCK_SIZE 16 // MD5 outputs a 16 byte digest
+
+/**************************** DATA TYPES ****************************/
+typedef unsigned char MD_BYTE; // 8-bit byte
+typedef unsigned int MD_WORD; // 32-bit word, change to "long" for 16-bit machines
+
+typedef struct {
+ MD_BYTE data[64];
+ MD_WORD datalen;
+ unsigned long long bitlen;
+ MD_WORD state[4];
+} MD5_CTX;
+
+/*********************** FUNCTION DECLARATIONS **********************/
+void md5_init(MD5_CTX *ctx);
+void md5_update(MD5_CTX *ctx, const MD_BYTE data[], size_t len);
+void md5_final(MD5_CTX *ctx, MD_BYTE hash[]);
+
+#endif // MD5_H
diff --git a/libyara/md5.c b/libyara/md5.c
new file mode 100644
index 0000000..887abcf
--- /dev/null
+++ b/libyara/md5.c
@@ -0,0 +1,189 @@
+/*********************************************************************
+* Filename: md5.c
+* Author: Brad Conte (brad AT bradconte.com)
+* Copyright:
+* Disclaimer: This code is presented "as is" without any guarantees.
+* Details: Implementation of the MD5 hashing algorithm.
+ Algorithm specification can be found here:
+ * http://tools.ietf.org/html/rfc1321
+ This implementation uses little endian byte order.
+*********************************************************************/
+
+/*************************** HEADER FILES ***************************/
+#include <stdlib.h>
+#include <memory.h>
+#include <yara/md5.h>
+
+/****************************** MACROS ******************************/
+#define ROTLEFT(a,b) ((a << b) | (a >> (32-b)))
+
+#define F(x,y,z) ((x & y) | (~x & z))
+#define G(x,y,z) ((x & z) | (y & ~z))
+#define H(x,y,z) (x ^ y ^ z)
+#define I(x,y,z) (y ^ (x | ~z))
+
+#define FF(a,b,c,d,m,s,t) { a += F(b,c,d) + m + t; \
+ a = b + ROTLEFT(a,s); }
+#define GG(a,b,c,d,m,s,t) { a += G(b,c,d) + m + t; \
+ a = b + ROTLEFT(a,s); }
+#define HH(a,b,c,d,m,s,t) { a += H(b,c,d) + m + t; \
+ a = b + ROTLEFT(a,s); }
+#define II(a,b,c,d,m,s,t) { a += I(b,c,d) + m + t; \
+ a = b + ROTLEFT(a,s); }
+
+/*********************** FUNCTION DEFINITIONS ***********************/
+void md5_transform(MD5_CTX *ctx, const MD_BYTE data[])
+{
+ MD_WORD a, b, c, d, m[16], i, j;
+
+ // MD5 specifies big endian byte order, but this implementation assumes a little
+ // endian byte order CPU. Reverse all the bytes upon input, and re-reverse them
+ // on output (in md5_final()).
+ for (i = 0, j = 0; i < 16; ++i, j += 4)
+ m[i] = (data[j]) + (data[j + 1] << 8) + (data[j + 2] << 16) + (data[j + 3] << 24);
+
+ a = ctx->state[0];
+ b = ctx->state[1];
+ c = ctx->state[2];
+ d = ctx->state[3];
+
+ FF(a,b,c,d,m[0], 7,0xd76aa478);
+ FF(d,a,b,c,m[1], 12,0xe8c7b756);
+ FF(c,d,a,b,m[2], 17,0x242070db);
+ FF(b,c,d,a,m[3], 22,0xc1bdceee);
+ FF(a,b,c,d,m[4], 7,0xf57c0faf);
+ FF(d,a,b,c,m[5], 12,0x4787c62a);
+ FF(c,d,a,b,m[6], 17,0xa8304613);
+ FF(b,c,d,a,m[7], 22,0xfd469501);
+ FF(a,b,c,d,m[8], 7,0x698098d8);
+ FF(d,a,b,c,m[9], 12,0x8b44f7af);
+ FF(c,d,a,b,m[10],17,0xffff5bb1);
+ FF(b,c,d,a,m[11],22,0x895cd7be);
+ FF(a,b,c,d,m[12], 7,0x6b901122);
+ FF(d,a,b,c,m[13],12,0xfd987193);
+ FF(c,d,a,b,m[14],17,0xa679438e);
+ FF(b,c,d,a,m[15],22,0x49b40821);
+
+ GG(a,b,c,d,m[1], 5,0xf61e2562);
+ GG(d,a,b,c,m[6], 9,0xc040b340);
+ GG(c,d,a,b,m[11],14,0x265e5a51);
+ GG(b,c,d,a,m[0], 20,0xe9b6c7aa);
+ GG(a,b,c,d,m[5], 5,0xd62f105d);
+ GG(d,a,b,c,m[10], 9,0x02441453);
+ GG(c,d,a,b,m[15],14,0xd8a1e681);
+ GG(b,c,d,a,m[4], 20,0xe7d3fbc8);
+ GG(a,b,c,d,m[9], 5,0x21e1cde6);
+ GG(d,a,b,c,m[14], 9,0xc33707d6);
+ GG(c,d,a,b,m[3], 14,0xf4d50d87);
+ GG(b,c,d,a,m[8], 20,0x455a14ed);
+ GG(a,b,c,d,m[13], 5,0xa9e3e905);
+ GG(d,a,b,c,m[2], 9,0xfcefa3f8);
+ GG(c,d,a,b,m[7], 14,0x676f02d9);
+ GG(b,c,d,a,m[12],20,0x8d2a4c8a);
+
+ HH(a,b,c,d,m[5], 4,0xfffa3942);
+ HH(d,a,b,c,m[8], 11,0x8771f681);
+ HH(c,d,a,b,m[11],16,0x6d9d6122);
+ HH(b,c,d,a,m[14],23,0xfde5380c);
+ HH(a,b,c,d,m[1], 4,0xa4beea44);
+ HH(d,a,b,c,m[4], 11,0x4bdecfa9);
+ HH(c,d,a,b,m[7], 16,0xf6bb4b60);
+ HH(b,c,d,a,m[10],23,0xbebfbc70);
+ HH(a,b,c,d,m[13], 4,0x289b7ec6);
+ HH(d,a,b,c,m[0], 11,0xeaa127fa);
+ HH(c,d,a,b,m[3], 16,0xd4ef3085);
+ HH(b,c,d,a,m[6], 23,0x04881d05);
+ HH(a,b,c,d,m[9], 4,0xd9d4d039);
+ HH(d,a,b,c,m[12],11,0xe6db99e5);
+ HH(c,d,a,b,m[15],16,0x1fa27cf8);
+ HH(b,c,d,a,m[2], 23,0xc4ac5665);
+
+ II(a,b,c,d,m[0], 6,0xf4292244);
+ II(d,a,b,c,m[7], 10,0x432aff97);
+ II(c,d,a,b,m[14],15,0xab9423a7);
+ II(b,c,d,a,m[5], 21,0xfc93a039);
+ II(a,b,c,d,m[12], 6,0x655b59c3);
+ II(d,a,b,c,m[3], 10,0x8f0ccc92);
+ II(c,d,a,b,m[10],15,0xffeff47d);
+ II(b,c,d,a,m[1], 21,0x85845dd1);
+ II(a,b,c,d,m[8], 6,0x6fa87e4f);
+ II(d,a,b,c,m[15],10,0xfe2ce6e0);
+ II(c,d,a,b,m[6], 15,0xa3014314);
+ II(b,c,d,a,m[13],21,0x4e0811a1);
+ II(a,b,c,d,m[4], 6,0xf7537e82);
+ II(d,a,b,c,m[11],10,0xbd3af235);
+ II(c,d,a,b,m[2], 15,0x2ad7d2bb);
+ II(b,c,d,a,m[9], 21,0xeb86d391);
+
+ ctx->state[0] += a;
+ ctx->state[1] += b;
+ ctx->state[2] += c;
+ ctx->state[3] += d;
+}
+
+void md5_init(MD5_CTX *ctx)
+{
+ ctx->datalen = 0;
+ ctx->bitlen = 0;
+ ctx->state[0] = 0x67452301;
+ ctx->state[1] = 0xEFCDAB89;
+ ctx->state[2] = 0x98BADCFE;
+ ctx->state[3] = 0x10325476;
+}
+
+void md5_update(MD5_CTX *ctx, const MD_BYTE data[], size_t len)
+{
+ size_t i;
+
+ for (i = 0; i < len; ++i) {
+ ctx->data[ctx->datalen] = data[i];
+ ctx->datalen++;
+ if (ctx->datalen == 64) {
+ md5_transform(ctx, ctx->data);
+ ctx->bitlen += 512;
+ ctx->datalen = 0;
+ }
+ }
+}
+
+void md5_final(MD5_CTX *ctx, MD_BYTE hash[])
+{
+ size_t i;
+
+ i = ctx->datalen;
+
+ // Pad whatever data is left in the buffer.
+ if (ctx->datalen < 56) {
+ ctx->data[i++] = 0x80;
+ while (i < 56)
+ ctx->data[i++] = 0x00;
+ }
+ else if (ctx->datalen >= 56) {
+ ctx->data[i++] = 0x80;
+ while (i < 64)
+ ctx->data[i++] = 0x00;
+ md5_transform(ctx, ctx->data);
+ memset(ctx->data, 0, 56);
+ }
+
+ // Append to the padding the total message's length in bits and transform.
+ ctx->bitlen += ctx->datalen * 8;
+ ctx->data[56] = ctx->bitlen;
+ ctx->data[57] = ctx->bitlen >> 8;
+ ctx->data[58] = ctx->bitlen >> 16;
+ ctx->data[59] = ctx->bitlen >> 24;
+ ctx->data[60] = ctx->bitlen >> 32;
+ ctx->data[61] = ctx->bitlen >> 40;
+ ctx->data[62] = ctx->bitlen >> 48;
+ ctx->data[63] = ctx->bitlen >> 56;
+ md5_transform(ctx, ctx->data);
+
+ // Since this implementation uses little endian byte ordering and MD uses big endian,
+ // reverse all the bytes when copying the final state to the output hash.
+ for (i = 0; i < 4; ++i) {
+ hash[i] = (ctx->state[0] >> (i * 8)) & 0x000000ff;
+ hash[i + 4] = (ctx->state[1] >> (i * 8)) & 0x000000ff;
+ hash[i + 8] = (ctx->state[2] >> (i * 8)) & 0x000000ff;
+ hash[i + 12] = (ctx->state[3] >> (i * 8)) & 0x000000ff;
+ }
+}
diff --git a/libyara/modules/pe.c b/libyara/modules/pe.c
index ceaaf82..7e3b7c8 100644
--- a/libyara/modules/pe.c
+++ b/libyara/modules/pe.c
@@ -21,8 +21,8 @@ limitations under the License.
#endif
#include <ctype.h>
-#include <openssl/evp.h>
#include <yara/modules.h>
+#include <yara/md5.h>
#include <yara/mem.h>
#include <yara/strutils.h>
@@ -2314,9 +2314,8 @@ define_function(imphash)
char *final_name;
size_t len;
int i;
- unsigned int md_len;
- EVP_MD_CTX mdctx;
- unsigned char md_value[EVP_MAX_MD_SIZE];
+ MD5_CTX ctx;
+ unsigned char md_value[MD5_BLOCK_SIZE];
char *final_hash;
char *hash = string_argument(1);
int first = 1;
@@ -2325,14 +2324,12 @@ define_function(imphash)
PIMPORT_FUNC_LIST cur_func_node = NULL;
YR_OBJECT* module = module();
PE* pe = (PE*) module->data;
- const EVP_MD *md = EVP_md5();
// If not a PE, return 0.
if (!pe)
return_integer(result);
- EVP_MD_CTX_init(&mdctx);
- EVP_DigestInit_ex(&mdctx, md, NULL);
+ md5_init(&ctx);
cur_dll_node = pe->imports;
while (cur_dll_node) {
@@ -2366,7 +2363,7 @@ define_function(imphash)
final_name[i] = tolower(final_name[i]);
}
- EVP_DigestUpdate(&mdctx, final_name, strlen(final_name));
+ md5_update(&ctx, (MD_BYTE *) final_name, strlen(final_name));
yr_free(final_name);
cur_func_node = cur_func_node->next;
@@ -2376,19 +2373,18 @@ define_function(imphash)
cur_dll_node = cur_dll_node->next;
}
- EVP_DigestFinal_ex(&mdctx, md_value, &md_len);
- EVP_MD_CTX_cleanup(&mdctx);
+ md5_final(&ctx, md_value);
// Convert md_value into it's hexlified form.
- final_hash = yr_malloc((md_len * 2));
+ final_hash = yr_malloc((MD5_BLOCK_SIZE * 2));
if (!final_hash)
return_integer(0);
p = final_hash;
- for (i = 0; i < md_len; i++)
+ for (i = 0; i < MD5_BLOCK_SIZE; i++)
snprintf(p + 2 * i, 3, "%02x", md_value[i]);
- if (strncasecmp(hash, final_hash, (md_len * 2)) == 0)
+ if (strncasecmp(hash, final_hash, (MD5_BLOCK_SIZE* 2)) == 0)
result = 1;
yr_free(final_hash);
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/forensics/yara.git
More information about the forensics-changes
mailing list