feat(pe): Expand PE attributes and filter fields

pkg/filter/accessor.go

@@ -34,6 +34,8 @@ var (
 // kevtAccessor extracts generic event values.
 type kevtAccessor struct{}
 
+func (kevtAccessor) setFields(fields []fields.Field) {}
+
 func newKevtAccessor() accessor {
 	return &kevtAccessor{}
 }
@@ -195,6 +197,10 @@ func (f *filter) narrowAccessors() {
 	if removeDNSAccessor {
 		f.removeAccessor(&dnsAccessor{})
 	}
+
+	for _, accessor := range f.accessors {
+		accessor.setFields(allFields)
+	}
 }
 
 func (f *filter) removeAccessor(removed accessor) {

pkg/filter/accessor_windows.go

@@ -19,9 +19,12 @@
 package filter
 
 import (
+	"errors"
 	"github.com/rabbitstack/fibratus/pkg/kevent/ktypes"
 	psnap "github.com/rabbitstack/fibratus/pkg/ps"
+	"github.com/rabbitstack/fibratus/pkg/sys"
 	"github.com/rabbitstack/fibratus/pkg/util/cmdline"
+	"github.com/rabbitstack/fibratus/pkg/util/signature"
 	"path/filepath"
 	"strconv"
 	"strings"
@@ -39,6 +42,8 @@ import (
 type accessor interface {
 	// get fetches the parameter value for the specified filter field.
 	get(f fields.Field, kevt *kevent.Kevent) (kparams.Value, error)
+	// setFields sets all fields declared in the expression
+	setFields(fields []fields.Field)
 }
 
 // getAccessors initializes and returns all available accessors.
@@ -70,6 +75,8 @@ type psAccessor struct {
 	psnap psnap.Snapshotter
 }
 
+func (psAccessor) setFields(fields []fields.Field) {}
+
 func newPSAccessor(psnap psnap.Snapshotter) accessor { return &psAccessor{psnap: psnap} }
 
 func (ps *psAccessor) get(f fields.Field, kevt *kevent.Kevent) (kparams.Value, error) {
@@ -514,6 +521,8 @@ func ancestorFields(field string, kevt *kevent.Kevent) (kparams.Value, error) {
 // threadAccessor fetches thread parameters from thread kernel events.
 type threadAccessor struct{}
 
+func (threadAccessor) setFields(fields []fields.Field) {}
+
 func newThreadAccessor() accessor {
 	return &threadAccessor{}
 }
@@ -580,6 +589,8 @@ func (t *threadAccessor) get(f fields.Field, kevt *kevent.Kevent) (kparams.Value
 // fileAccessor extracts file specific values.
 type fileAccessor struct{}
 
+func (fileAccessor) setFields(fields []fields.Field) {}
+
 func newFileAccessor() accessor {
 	return &fileAccessor{}
 }
@@ -622,6 +633,8 @@ func (l *fileAccessor) get(f fields.Field, kevt *kevent.Kevent) (kparams.Value,
 // imageAccessor extracts image (DLL) event values.
 type imageAccessor struct{}
 
+func (imageAccessor) setFields(fields []fields.Field) {}
+
 func newImageAccessor() accessor {
 	return &imageAccessor{}
 }
@@ -661,6 +674,8 @@ func (i *imageAccessor) get(f fields.Field, kevt *kevent.Kevent) (kparams.Value,
 // registryAccessor extracts registry specific parameters.
 type registryAccessor struct{}
 
+func (registryAccessor) setFields(fields []fields.Field) {}
+
 func newRegistryAccessor() accessor {
 	return &registryAccessor{}
 }
@@ -687,6 +702,8 @@ func (r *registryAccessor) get(f fields.Field, kevt *kevent.Kevent) (kparams.Val
 // networkAccessor deals with extracting the network specific kernel event parameters.
 type networkAccessor struct{}
 
+func (networkAccessor) setFields(fields []fields.Field) {}
+
 func newNetworkAccessor() accessor { return &networkAccessor{} }
 
 func (n *networkAccessor) get(f fields.Field, kevt *kevent.Kevent) (kparams.Value, error) {
@@ -718,6 +735,8 @@ func (n *networkAccessor) get(f fields.Field, kevt *kevent.Kevent) (kparams.Valu
 // handleAccessor extracts handle event values.
 type handleAccessor struct{}
 
+func (handleAccessor) setFields(fields []fields.Field) {}
+
 func newHandleAccessor() accessor { return &handleAccessor{} }
 
 func (h *handleAccessor) get(f fields.Field, kevt *kevent.Kevent) (kparams.Value, error) {
@@ -735,21 +754,100 @@ func (h *handleAccessor) get(f fields.Field, kevt *kevent.Kevent) (kparams.Value
 }
 
 // peAccessor extracts PE specific values.
-type peAccessor struct{}
+type peAccessor struct {
+	fields []fields.Field
+}
+
+func (pa *peAccessor) setFields(fields []fields.Field) {
+	pa.fields = fields
+}
+
+func (pa *peAccessor) parserOpts() []pe.Option {
+	var opts []pe.Option
+	for _, f := range pa.fields {
+		if f.IsPeSection() || f.IsPeSectionsMap() {
+			opts = append(opts, pe.WithSections())
+		}
+		if f.IsPeSymbol() {
+			opts = append(opts, pe.WithSymbols())
+		}
+		if f.IsPeSectionEntropy() {
+			opts = append(opts, pe.WithSectionEntropy())
+		}
+		if f.IsPeVersionResource() || f.IsPeResourcesMap() {
+			opts = append(opts, pe.WithVersionResources())
+		}
+		if f.IsPeImphash() {
+			opts = append(opts, pe.WithImphash())
+		}
+		if f.IsPeDotnet() {
+			opts = append(opts, pe.WithCLR())
+		}
+		if f.IsPeAnomalies() {
+			opts = append(opts, pe.WithSections(), pe.WithSymbols())
+		}
+		if f.IsPeSignature() {
+			opts = append(opts, pe.WithSecurity())
+		}
+	}
+	return opts
+}
+
+// ErrPENilCertificate indicates the PE certificate is not available
+var ErrPENilCertificate = errors.New("pe certificate is nil")
 
 func newPEAccessor() accessor {
 	return &peAccessor{}
 }
 
-func (*peAccessor) get(f fields.Field, kevt *kevent.Kevent) (kparams.Value, error) {
+func (pa *peAccessor) get(f fields.Field, kevt *kevent.Kevent) (kparams.Value, error) {
 	var p *pe.PE
 	if kevt.PS != nil && kevt.PS.PE != nil {
 		p = kevt.PS.PE
 	}
+	// PE enrichment is likely disabled. Load PE data lazily
+	// by only requesting parsing of the PE directories that
+	// are relevant to the fields present in the expression
+	if (kevt.PS != nil && kevt.PS.Exe != "") && p == nil {
+		var err error
+		exe := kevt.PS.Exe
+		p, err = pe.ParseFile(exe, pa.parserOpts()...)
+		if err != nil {
+			return nil, err
+		}
+		if p != nil && f.IsPeSignature() {
+			// verify embedded signature
+			if p.IsSigned && f.IsPeIsTrusted() {
+				p.VerifySignature()
+			}
+			if !p.IsSigned {
+				if !sys.IsWintrustFound() {
+					goto cmp
+				}
+				// maybe the PE is catalog signed?
+				catalog := signature.NewCatalog()
+				err := catalog.Open(exe)
+				if err != nil {
+					goto cmp
+				}
+				defer catalog.Close()
+				p.IsSigned = catalog.IsCatalogSigned()
+				if p.IsSigned && f.IsPeIsTrusted() {
+					p.IsTrusted = catalog.Verify(exe)
+				}
+				if p.IsSigned && f.IsPeCert() {
+					p.Cert, _ = catalog.ParseCertificate()
+				}
+			}
+		}
+		kevt.PS.PE = p
+	}
+
 	if p == nil {
 		return nil, nil
 	}
 
+cmp:
 	switch f {
 	case fields.PeEntrypoint:
 		return p.EntryPoint, nil
@@ -763,6 +861,47 @@ func (*peAccessor) get(f fields.Field, kevt *kevent.Kevent) (kparams.Value, erro
 		return p.Symbols, nil
 	case fields.PeImports:
 		return p.Imports, nil
+	case fields.PeImphash:
+		return p.Imphash, nil
+	case fields.PeIsDotnet:
+		return p.IsDotnet, nil
+	case fields.PeAnomalies:
+		return p.Anomalies, nil
+	case fields.PeIsSigned:
+		return p.IsSigned, nil
+	case fields.PeIsTrusted:
+		return p.IsTrusted, nil
+	case fields.PeCertIssuer:
+		if p.Cert == nil {
+			return nil, ErrPENilCertificate
+		}
+		return p.Cert.Issuer, nil
+	case fields.PeCertSubject:
+		if p.Cert == nil {
+			return nil, ErrPENilCertificate
+		}
+		return p.Cert.Subject, nil
+	case fields.PeCertSerial:
+		if p.Cert == nil {
+			return nil, ErrPENilCertificate
+		}
+		return p.Cert.SerialNumber, nil
+	case fields.PeCertAfter:
+		if p.Cert == nil {
+			return nil, ErrPENilCertificate
+		}
+		return p.Cert.NotAfter, nil
+	case fields.PeCertBefore:
+		if p.Cert == nil {
+			return nil, ErrPENilCertificate
+		}
+		return p.Cert.NotBefore, nil
+	case fields.PeIsDLL:
+		return kevt.Kparams.GetBool(kparams.FileIsDLL)
+	case fields.PeIsDriver:
+		return kevt.Kparams.GetBool(kparams.FileIsDriver)
+	case fields.PeIsExecutable:
+		return kevt.Kparams.GetBool(kparams.FileIsExecutable)
 	case fields.PeCompany:
 		return p.VersionResources[pe.Company], nil
 	case fields.PeCopyright:
@@ -816,6 +955,8 @@ func (*peAccessor) get(f fields.Field, kevt *kevent.Kevent) (kparams.Value, erro
 // memAccessor extracts parameters from memory alloc/free events.
 type memAccessor struct{}
 
+func (memAccessor) setFields(fields []fields.Field) {}
+
 func newMemAccessor() accessor {
 	return &memAccessor{}
 }
@@ -841,6 +982,8 @@ func (*memAccessor) get(f fields.Field, kevt *kevent.Kevent) (kparams.Value, err
 // dnsAccessor extracts values from DNS query/response event parameters.
 type dnsAccessor struct{}
 
+func (dnsAccessor) setFields(fields []fields.Field) {}
+
 func newDNSAccessor() accessor {
 	return &dnsAccessor{}
 }

pkg/filter/accessor_windows_test.go

@@ -26,6 +26,7 @@ import (
 	ptypes "github.com/rabbitstack/fibratus/pkg/ps/types"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"reflect"
 	"testing"
 	"time"
 )
@@ -100,3 +101,49 @@ func TestCaptureInBrackets(t *testing.T) {
 	assert.Equal(t, ".debug$S", v)
 	assert.Equal(t, fields.SectionEntropy, subfield)
 }
+
+func TestNarrowAccessors(t *testing.T) {
+	var tests = []struct {
+		f                 Filter
+		expectedAccessors int
+	}{
+		{
+			New(`ps.name = 'cmd.exe' and kevt.name = 'CreateProcess' or kevt.name in ('TerminateProcess', 'CreateFile')`, cfg),
+			2,
+		},
+		{
+			New(`ps.modules[kernel32.dll].location = 'C:\\Windows\\System32'`, cfg),
+			1,
+		},
+		{
+			New(`handle.type = 'Section' and pe.sections > 1 and kevt.name = 'CreateHandle'`, cfg),
+			3,
+		},
+		{
+			New(`sequence |kevt.name = 'CreateProcess'| as e1 |kevt.name = 'CreateFile' and file.name = $e1.ps.exe |`, cfg),
+			3,
+		},
+		{
+			New(`base(file.name) = 'kernel32.dll'`, cfg),
+			1,
+		},
+	}
+
+	var pea *peAccessor
+
+	for i, tt := range tests {
+		require.NoError(t, tt.f.Compile())
+		naccessors := len(tt.f.(*filter).accessors)
+		if tt.expectedAccessors != naccessors {
+			t.Errorf("%d. accessors mismatch: exp=%d got=%d", i, tt.expectedAccessors, naccessors)
+		}
+		for _, a := range tt.f.(*filter).accessors {
+			if reflect.TypeOf(a) == reflect.TypeOf(&peAccessor{}) {
+				pea = a.(*peAccessor)
+			}
+		}
+	}
+	// check if fields are set in the accessor
+	require.NotNil(t, pea)
+	assert.Len(t, pea.fields, 3)
+}

pkg/filter/fields/fields.go

@@ -62,3 +62,8 @@ func IsDeprecated(f Field) (bool, *Deprecation) {
 	}
 	return false, nil
 }
+
+// IsBoolean determines if the given field has the bool type.
+func IsBoolean(f Field) bool {
+	return fields[f].Type == kparams.Bool
+}