100 Days of YARA – Day 3: ELF Files

In the previous post, we outlined methods to identify PE files. This post will show the same concepts, but applied to ELF files.

Method 1: String

rule elf_file_method1
{
	meta:
		description = "ELF file '\x7fELF' header as string"
		author = "Daniel Roberson"

	strings:
		$elf = "\x7fELF"

	condition:
		$elf at 0
}

Method 2: Integer

rule elf_file_method2
{
	meta:
		description = "ELF file '\x7fELF' header as uint32"
		author = "Daniel Roberson"

	condition:
		uint32(0) == 0x464c457f
}

Method 3: “elf” Module

import "elf"

rule elf_file_method3
{
	meta:
		description = "ELF file with 'elf' module"
		author = "Daniel Roberson"

	condition:
		elf.type
}

Performance

for i in $(seq 10); do (time yara -r elf.yar /usr 2>&1) 2>&1|tail -n 1 | awk {'print $6'}; done
Method 1 (string)Method 2 (uint32)Method 3 (elf Module)Dummy Rule
45.7641.41110.8843.93
44.1341.85110.8642.34
45.3143.40111.0841.53
44.9046.11111.2044.55
42.3743.82109.9745.14
41.6844.76109.6043.37
42.5745.73110.2641.98
43.2144.01113.5142.11
46.1543.73108.8143.01
44.2943.82110.1842.61
average
44.0343.86110.6443.06

Predictably, the uint32 method was the fastest, but not much faster than the string method. Using YARA’s ELF module was much slower for the simple identification of ELF files.


YARA Rules Index

One thought on “100 Days of YARA – Day 3: ELF Files

  1. Pingback: YARA Rules Index – DMFR SECURITY

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s