Integration with Yara

3rdPartyLibs/output/output.txt

@@ -0,0 +1,5 @@
+warning: rule "Detect_IMUL_Instruction" in D:\MASTER\reverse\RepoTest\REVERSE_ENGINEERING-PROJECT\3rdPartyLibs\rules\Detect_Imul.yara(10): string "$imul_triple_with_byte" may slow down scanning
+Detect_IMUL_Instruction [] [description="Detecteaza instructiuni IMUL (x86)"] D:\MASTER\reverse\RepoTest\REVERSE_ENGINEERING-PROJECT\3rdPartyLibs\viruses\p12
+0x46b:$imul_standard_2ops: 0F AF 45 F8
+0x475:$imul_standard_2ops: 0F AF 4D F8
+0x479:$imul_triple_with_byte: 6B D1 03

3rdPartyLibs/results/results_2026-01-30_16-59-27.txt

@@ -0,0 +1,87 @@
+=== SCANNING RESULTS ===
+
+Summary:
+    Total Matches: 1
+    Status: INFECTED
+
+-------------------------------------------------------------
+Scanning with rule: Detect_Imul.yara
+    [WARNING] warning: rule "Detect_IMUL_Instruction" in
+        D:\reverse\project\REVERSE_ENGINEERING-PROJECT\3rdPartyLibs\rules\Detect_Imul.yara(10):
+        string "$imul_triple_with_byte" may slow down scanning
+    [MATCH] Rule: Detect_IMUL_Instruction
+        0x46b:$imul_standard_2ops: 0F AF 45 F8
+        At:
+           Hex Dump:
+           File offset: 0x46B
+           Section: .text
+               0x0000042b  CC CC CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC  .....U..].......
+               0x0000043b  CC CC CC CC CC 55 8B EC 83 EC 4C 53 56 57 B9 A2  .....U....LSVW..
+               0x0000044b  50 40 00 E8 B7 FF FF FF C7 45 FC 02 00 00 00 C7  P@.......E......
+               0x0000045b  45 F8 02 00 00 00 C7 45 F4 02 00 00 00 8B 45 FC  E......E......E.
+               0x0000046b  0F AF 45 F8 83 C0 02 8B 4D FC 0F AF 4D F8 6B D1  ..E.....M...M.k.
+               0x0000047b  03 3B C2 7D 14 8B 45 F4 83 E8 01 83 F8 05 7D 07  .;.}..E.......}.
+               0x0000048b  C7 45 F4 08 00 00 00 EB 1E 8B 45 F4 03 45 FC 03  .E........E..E..
+               0x0000049b  45 F8 83 F8 03 75 09 C7 45 F4 14 00 00 00 EB 07  E....u..E.......
+           Disassembly:
+               0x0000046b imul eax, dword ptr [rbp - 8]
+               0x0000046f add eax, 2
+               0x00000472 mov ecx, dword ptr [rbp - 4]
+               0x00000475 imul ecx, dword ptr [rbp - 8]
+               0x00000479 imul edx, ecx, 3
+               0x0000047c cmp eax, edx
+               0x0000047e jge 0x494
+               0x00000480 mov eax, dword ptr [rbp - 0xc]
+               0x00000483 sub eax, 1
+               0x00000486 cmp eax, 5
+               0x00000489 jge 0x492
+        0x475:$imul_standard_2ops: 0F AF 4D F8
+        At:
+           Hex Dump:
+           File offset: 0x475
+           Section: .text
+               0x00000435  CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 EC  ...........U....
+               0x00000445  4C 53 56 57 B9 A2 50 40 00 E8 B7 FF FF FF C7 45  LSVW..P@.......E
+               0x00000455  FC 02 00 00 00 C7 45 F8 02 00 00 00 C7 45 F4 02  ......E......E..
+               0x00000465  00 00 00 8B 45 FC 0F AF 45 F8 83 C0 02 8B 4D FC  ....E...E.....M.
+               0x00000475  0F AF 4D F8 6B D1 03 3B C2 7D 14 8B 45 F4 83 E8  ..M.k..;.}..E...
+               0x00000485  01 83 F8 05 7D 07 C7 45 F4 08 00 00 00 EB 1E 8B  ....}..E........
+               0x00000495  45 F4 03 45 FC 03 45 F8 83 F8 03 75 09 C7 45 F4  E..E..E....u..E.
+               0x000004a5  14 00 00 00 EB 07 C7 45 F4 1E 00 00 00 8B 45 F4  .......E......E.
+           Disassembly:
+               0x00000475 imul ecx, dword ptr [rbp - 8]
+               0x00000479 imul edx, ecx, 3
+               0x0000047c cmp eax, edx
+               0x0000047e jge 0x494
+               0x00000480 mov eax, dword ptr [rbp - 0xc]
+               0x00000483 sub eax, 1
+               0x00000486 cmp eax, 5
+               0x00000489 jge 0x492
+               0x0000048b mov dword ptr [rbp - 0xc], 8
+               0x00000492 jmp 0x4b2
+        0x479:$imul_triple_with_byte: 6B D1 03
+        At:
+           Hex Dump:
+           File offset: 0x479
+           Section: .text
+               0x00000439  CC CC CC CC CC CC CC 55 8B EC 83 EC 4C 53 56 57  .......U....LSVW
+               0x00000449  B9 A2 50 40 00 E8 B7 FF FF FF C7 45 FC 02 00 00  ..P@.......E....
+               0x00000459  00 C7 45 F8 02 00 00 00 C7 45 F4 02 00 00 00 8B  ..E......E......
+               0x00000469  45 FC 0F AF 45 F8 83 C0 02 8B 4D FC 0F AF 4D F8  E...E.....M...M.
+               0x00000479  6B D1 03 3B C2 7D 14 8B 45 F4 83 E8 01 83 F8 05  k..;.}..E.......
+               0x00000489  7D 07 C7 45 F4 08 00 00 00 EB 1E 8B 45 F4 03 45  }..E........E..E
+               0x00000499  FC 03 45 F8 83 F8 03 75 09 C7 45 F4 14 00 00 00  ..E....u..E.....
+               0x000004a9  EB 07 C7 45 F4 1E 00 00 00 8B 45 F4 83 C0 02 89  ...E......E.....
+           Disassembly:
+               0x00000479 imul edx, ecx, 3
+               0x0000047c cmp eax, edx
+               0x0000047e jge 0x494
+               0x00000480 mov eax, dword ptr [rbp - 0xc]
+               0x00000483 sub eax, 1
+               0x00000486 cmp eax, 5
+               0x00000489 jge 0x492
+               0x0000048b mov dword ptr [rbp - 0xc], 8
+               0x00000492 jmp 0x4b2
+               0x00000494 mov eax, dword ptr [rbp - 0xc]
+
+=== SCAN COMPLETE ===

3rdPartyLibs/rules/Detect_Imul.yara

@@ -0,0 +1,18 @@
+import "pe"
+
+rule Detect_IMUL_Instruction
+{
+    meta:
+        description = "Detecteaza instructiuni IMUL (x86)"
+
+    strings:
+        $imul_standard_2ops = { 0F AF ?? ?? } // imul reg, [mem]
+        $imul_triple_with_byte = { 6B (C? | D? | E? | F?) ?? } // imul reg, reg, imm8
+
+    condition:
+        pe.is_pe and any of them in (
+        pe.sections[pe.section_index(".text")].raw_data_offset .. 
+        pe.sections[pe.section_index(".text")].raw_data_offset + 
+        pe.sections[pe.section_index(".text")].raw_data_size
+    )
+}

3rdPartyLibs/rules/Hardcoded_Bytes.yara

@@ -0,0 +1,11 @@
+rule Hardcoded_Bytes {
+    meta:
+        description = "Detects hardcoded byte pattern "
+        severity = "high"
+
+    strings:
+        $xor = { 1F 0A 1F 0A }
+
+    condition:
+        $xor
+}

3rdPartyLibs/rules/helloworld - Copy.yara

@@ -0,0 +1,13 @@
+rule hello_world_str {
+
+    meta:
+        description = "A simple proof-of-concept to show YARA rules"
+        author = "Carcea Razvan"
+
+    strings:
+        $hello = "Hello World!"
+
+    condition:
+        $hello
+
+}

3rdPartyLibs/rules/helloworld.yara

@@ -0,0 +1,32 @@
+rule hello_str : test demo poc{
+
+    meta:
+        description = "A simple proof-of-concept to show YARA rules"
+        author = "Carcea Razvan"
+        severity = "low"
+
+
+    strings:
+        $hello = "Hello"
+        $world = "World"
+
+    condition:
+        $hello or $world
+
+}
+
+rule world_str : malware demo{
+
+    meta:
+        description = "Demo"
+        author = "Carcea Diana"
+        severity = "high"
+
+
+    strings:
+        $world = "World"
+
+    condition:
+        $world
+
+}

3rdPartyLibs/rules/p1_find_integer_2.yara

@@ -0,0 +1,12 @@
+rule find_integer_2 {
+    meta:
+        description = "Matches x86 opcode sequence for mov dword ptr [ebp-?], 2"
+
+    strings:
+        $mov_i_2 = { C7 45 ?? 02 00 00 00 }
+
+    condition:
+        $mov_i_2
+
+}
+

3rdPartyLibs/rules/simple_beacon.yara

@@ -0,0 +1,11 @@
+rule C2_Beacon {
+    meta:
+        description = "Identifies indicators of simple HTTP-based C2 beaconing"
+
+    strings:
+        $url = /http(s)?:\/\/.*\/api/
+        $beacon = "beacon"
+
+    condition:
+        $url and $beacon
+}

3rdPartyLibs/rules/suspicious_admin.yara

@@ -0,0 +1,16 @@
+rule admin_tool {
+
+    meta:
+        description = "Detects suspicious admin-like command execution"
+        author = "Carcea Razvan"
+
+    strings:
+        $cmd1 = "whoami"
+        $cmd2 = "ipconfig"
+        $cmd3 = "net user"
+        $log  = "output.log"
+
+    condition:
+        2 of ($cmd*) and $log
+
+}

CMakeLists.txt

@@ -23,6 +23,15 @@ endif()
 
 project(${CURRENT_PROJECT_NAME} VERSION 1.0 DESCRIPTION "GView - GenericViewer" LANGUAGES C CXX)
 
+# --- Capstone static library ---
+add_library(Capstone STATIC IMPORTED)
+
+# Path către lib-ul static
+set_target_properties(Capstone PROPERTIES
+    IMPORTED_LOCATION "${CMAKE_CURRENT_SOURCE_DIR}/3rdPartyLibs/capstone/lib/capstone.lib"
+    INTERFACE_INCLUDE_DIRECTORIES "${CMAKE_CURRENT_SOURCE_DIR}/3rdPartyLibs/capstone/include"
+)
+
 include(CheckIPOSupported)
 check_ipo_supported(RESULT supported OUTPUT error)
 
@@ -156,6 +165,9 @@ add_subdirectory(3rdPartyLibs/LLVMDemangle)
 add_subdirectory(AppCUI)
 add_subdirectory(GViewCore)
 
+target_link_libraries(GViewCore PRIVATE Capstone)
+
+
 if(NOT DEFINED CMAKE_TESTING_ENABLED)
     add_subdirectory(GView)
 endif()

GViewCore/CMakeLists.txt

@@ -115,6 +115,7 @@ include_directories(src/View/DissasmViewer)
 include_directories(src/View/TextViewer)
 include_directories(src/View/ContainerViewer)
 include_directories(src/View/LexicalViewer)
+include_directories(src/View/YaraViewer)
 add_subdirectory(src)
 
 

GViewCore/include/GView.hpp

@@ -1194,6 +1194,18 @@ namespace View
         };
     }; // namespace ImageViewer
 
+    namespace YaraViewer
+    {
+
+        struct CORE_EXPORT Settings {
+            void* data;
+
+            Settings();
+            void SetAnalysisLevel(int analysisLevel);
+
+        };
+    }; // namespace YaraViewer
+
     namespace ContainerViewer
     {
         struct CORE_EXPORT EnumerateInterface {
@@ -1679,7 +1691,7 @@ namespace View
 
             Settings();
         };
-    }; // namespace DissasmViewer
+    }; // namespace DissasmViewer 
 
     struct CORE_EXPORT WindowInterface {
         virtual Reference<Object> GetObject()                          = 0;
@@ -1691,6 +1703,8 @@ namespace View
         virtual bool CreateViewer(TextViewer::Settings& settings)      = 0;
         virtual bool CreateViewer(ContainerViewer::Settings& settings) = 0;
         virtual bool CreateViewer(LexicalViewer::Settings& settings)   = 0;
+        virtual bool CreateViewer(YaraViewer::Settings& settings)      = 0;
+
         virtual Reference<ViewControl> GetCurrentView()                = 0;
         virtual uint32 GetViewsCount()                                 = 0;
         virtual Reference<ViewControl> GetViewByIndex(uint32 index)    = 0;

GViewCore/src/App/FileWindow.cpp

@@ -6,6 +6,7 @@
 #include "TextViewer.hpp"
 #include "ContainerViewer.hpp"
 #include "LexicalViewer.hpp"
+#include "YaraViewer.hpp"
 
 using namespace GView::App;
 using namespace GView::App::InstanceCommands;
@@ -158,6 +159,11 @@ bool FileWindow::CreateViewer(GView::View::LexicalViewer::Settings& settings)
           .IsValid();
 }
 
+bool FileWindow::CreateViewer(GView::View::YaraViewer::Settings& settings)
+{
+    return this->view->CreateChildControl<GView::View::YaraViewer::Instance>(Reference<GView::Object>(this->obj.get()), &settings).IsValid();
+}
+
 Reference<ViewControl> FileWindow::GetCurrentView()
 {
     return view->GetCurrentTab().ToObjectRef<ViewControl>();

GViewCore/src/View/CMakeLists.txt

@@ -6,4 +6,5 @@ add_subdirectory(GridViewer)
 add_subdirectory(DissasmViewer)
 add_subdirectory(TextViewer)
 add_subdirectory(ContainerViewer)
-add_subdirectory(LexicalViewer)
+add_subdirectory(LexicalViewer)
+add_subdirectory(YaraViewer)

GViewCore/src/View/YaraViewer/CMakeLists.txt

@@ -0,0 +1 @@
+target_sources(GViewCore PRIVATE YaraViewer.hpp Config.cpp GoToDialog.cpp Instance.cpp Settings.cpp)

GViewCore/src/View/YaraViewer/Config.cpp

@@ -0,0 +1,24 @@
+#include "YaraViewer.hpp"
+
+using namespace GView::View::YaraViewer;
+using namespace AppCUI::Input;
+
+void Config::Update(IniSection sect)
+{
+    //sect.UpdateValue("Key.WrapMethod", Key::F2, true);
+}
+void Config::Initialize()
+{
+    //auto ini = AppCUI::Application::GetAppSettings();
+    //if (ini)
+    //{
+    //    auto sect           = ini->GetSection("View.Text");
+    //    this->Keys.WordWrap = sect.GetValue("Key.WrapMethod").ToKey(Key::F2);
+    //}
+    //else
+    //{
+    //    this->Keys.WordWrap = Key::F2;
+    //}
+
+    this->Loaded = true;
+}

GViewCore/src/View/YaraViewer/GoToDialog.cpp

@@ -0,0 +1,5 @@
+#include "YaraViewer.hpp"
+
+using namespace GView::View::YaraViewer;
+using namespace AppCUI::Input;
+