zeropointdynamics / zelos

A comprehensive binary emulation and instrumentation platform.
GNU Affero General Public License v3.0
408 stars 50 forks source link

Plugin yarascan error _xref_cnts at YaraMatch #129

Closed dmknght closed 3 years ago

dmknght commented 3 years ago

Describe the bug I'm testing zelos with yarascan plugin that matches "Hello World" string in memory. I got this error during the test:

Traceback (most recent call last):
  File "/usr/local/lib/python3.8/dist-packages/zelos/engine.py", line 593, in close
    closure()
  File "/usr/local/lib/python3.8/dist-packages/zelos/ext/plugins/yarascan/yarascan.py", line 307, in closure
    list(
  File "/usr/local/lib/python3.8/dist-packages/zelos/ext/plugins/yarascan/yarascan.py", line 378, in matches
    self._log(match.info(brief))
  File "/usr/local/lib/python3.8/dist-packages/zelos/ext/plugins/yarascan/yarascan.py", line 234, in info
    for i, s in enumerate(self.strings):
  File "/usr/local/lib/python3.8/dist-packages/zelos/ext/plugins/yarascan/yarascan.py", line 184, in strings
    self._yara_strings = [
  File "/usr/local/lib/python3.8/dist-packages/zelos/ext/plugins/yarascan/yarascan.py", line 185, in <listcomp>
    YaraString(self.region_address + s[0], s, self._xref_cnts[i])
AttributeError: 'YaraMatch' object has no attribute '_xref_cnts'

To Reproduce Steps to reproduce the behavior:

  1. Generate test file
    
    #include <stdio.h>

int main() { printf("Hello world\n"); return 0; }

compile `gcc test.c -o run`
2. Generate yara rule

rule hello_world: zelos { strings: $1 = "Hello world" condition: $1 }


(test binary file with yara has no error)
3. Run command `zelos --yara_file basic_rule.yar /tmp/run`
4. See error

**Expected behavior**
I think program should show `Matched` message.

**Screenshots**
![Screenshot at 2020-11-10 07-55-32](https://user-images.githubusercontent.com/29118926/98614019-7aefdc00-22ef-11eb-81f8-d1e061f3c956.png)

**Additional context**
- I installed zelos via pip3 `sudo pip3 install zelos`.