Extend dotnet module

[tarterp]

Overview

This large PR is to extend the dotnet parsing capabilities to look into the .NET directory and MetaData tables further. Not all MetaData tables are being handled, just a few that have been found useful. Further table parsing could be added in the future. This will greatly extend yara capabilities combatting .NET malware that has been previously not available or requiring very complex yara rules.

• Parse more of the .NET Directory, of most notice being the flags and entry point
• Parse the following MetaData Tables
  • Module
  • Typeref
  • Method
  • ImplMap

Examples

Two examples are provided below, there are more in the tests and documentation. These examples take advantage of the new feature is_dotnet.

Mixed Mode

import "pe"
import "dotnet"

rule mixed_mode {
    condition:
      pe.is_pe and
      dotnet.is_dotnet and
      dotnet.Flags & dotnet.COMIMAGE_FLAGS_ILONLY == 0
}

MemberRefs with order preference (if only malware was always this easy)

import "pe"
import "dotnet"

rule memberref_order {
  condition:
    pe.is_pe and
    dotnet.is_dotnet and
    for any i in (0..dotnet.number_of_memberrefs - 1): (
        dotnet.memberrefs[i].name == "GetCurrentProcess" and
        dotnet.memberrefs[i+1].name == "AntiDebug" and
        dotnet.memberrefs[i+2].name == "SystemEnumeration" and
        dotnet.memberrefs[i+3].name == "SendHostInfo" and
        dotnet.memberrefs[i+4].name == "HandlerLoop"
    )
}

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

For more information, open the CLA check for this pull request.

[wxsBSD]

s/major/minor/

[wxsBSD]

Mostly just minor nits with this, but I very much like this PR!

[wxsBSD]

represents an RVA to a managed entrypoint.

This way it is clear that in both cases it is an RVA.

[wxsBSD]

Nit: whitespace added here.

[wxsBSD]

Nit: extra newlines here.

[wxsBSD]

I noticed you're adding this _MASK definition but I'm not sure how useful it will be, as you're really just exposing it as a constant in the module without actually using it anywhere. Can we simplify a bit by removing this construct in the few places you're using it?

[wxsBSD]

This seems to be a copy/paste mistake. :)

[tarterp]

updated per comments given.

[wxsBSD]

Apologies for the delay, this completely slipped off my radar. I just took a quick look through this and it looks good to me!

[plusvic]

Looks good to me. The only thing I miss is adding .. versionadded:: 4.3.0 to the new fields in the documentation.