X41 D-Sec GmbH Security Advisory X41-2021-001: Multiple Vulnerabilities in YARA
X41 D-Sec GmbH Advisories <[email protected]> Fri, 29 Jan 2021 11:12:40 +0100
| Newsgroups | gmane.comp.security.fulldisclosure,gmane.comp.security.bugtraq |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--------------2E5FE0556E296D780D47341F
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
X41 D-Sec GmbH Security Advisory: X41-2021-001
Multiple Vulnerabilities in YARA
================================
Highest Severity Rating: Medium
Confirmed Affected Versions: YARA v4.0.3 and earlier
Confirmed Patched Versions: YARA v4.0.4
Vendor: VirusTotal (Google Inc.)
Vendor URL: https://virustotal.github.io/yara
Credit: X41 D-Sec GmbH, Luis Merino
Status: Public
Advisory-URL: https://www.x41-dsec.de/lab/advisories/x41-2021-001-yara
Summary and Impact
------------------
An integer overflow and several buffer overflow reads in
libyara/modules/macho/macho.c in YARA v4.0.3 and earlier could allow an
attacker to either cause denial of service or information disclosure
via a malicious Mach-O file.
Product Description
-------------------
According to the official project description:
Integer overflow in macho_parse_fat_file()
==========================================
Severity Rating: Medium
Vector: Mach-O file sample
CVE: Pending
CWE: 190
Analysis
--------
An integer overflow in macho_parse_fat_file() while processing the
fat Mach-O file header can lead to arbitrary read.
if (size < arch.offset + arch.size)
continue;
/* Force 'file' array entry creation. */
set_integer(YR_UNDEFINED, object, "file[%i].magic", i);
/* Get specific Mach-O file data. */
macho_parse_file(
data + arch.offset,
arch.size,
get_object(object, "file[%i]", i),
context);
When the arch.offset + arch.size result does not fit in the uint64_t type
the result will wrap around and might allow to bypass the
size < arch.offset + arch.size sanity check. Afterwards,
macho_parse_file() will be called with buffer and size values that
could be invalid, resulting in arbitrary read and plausible infoleakage or a
denial of service.
Proof of Concept
----------------
Parse the
https://github.com/x41sec/advisories/tree/master/X41-2021-001/yara-reproducers/int-overflow-macho-parse-fat-file
sample via yr_rules_scan_mem().
Out-of-bounds reads in macho_parse_file() and others
====================================================
Severity Rating: Medium
Vector: Mach-O file sample
CVE: Pending
CWE: 125
Analysis
--------
Two for-loops iterate over input buffer data to extract and process
segments and other commands. Incorrect sanity checks lead to out of
bounds reads in several places.
It is also recommended to perform a sanity check on
command_struct.cmdsize, discarding those values where
command_struct.cmdsize<sizeof(yr_load_command_t).
for (unsigned i = 0; i < header.ncmds; i++)
{
- - if (command - data < sizeof(yr_load_command_t))
+ if (data + size < command + sizeof(yr_load_command_t))
break;
memcpy(&command_struct, command, sizeof(yr_load_command_t));
if (should_swap)
swap_load_command(&command_struct);
- - if (size < header_size + command_struct.cmdsize)
+ if (size - (command - data) < command_struct.cmdsize ||
command_struct.cmdsize < sizeof(yr_load_command_t))
break;
Please note that this needs to be patched in the two similar for-loops.
Proof of Concept
----------------
Parse the
https://github.com/x41sec/advisories/tree/master/X41-2021-001/yara-reproducers/oob-macho-parse-file
sample via yr_rules_scan_mem().
Out-of-bounds reads in macho_handle_segment_64() and others
===========================================================
Severity Rating: Medium
Vector: Mach-O file sample
CVE: Pending
CWE: 125
Analysis
--------
macho_handle_segment_64() reads sizeof(yr_segment_command_64_t) bytes
from command without checking if the buffer is big enough.
memcpy(&sg, command, sizeof(yr_segment_command_64_t));
This results in an out of bounds read when command is not big enough.
Infoleak
or denial of service could be a plausible outcome.
It is recommended to check at least sizeof(yr_segment_command_64_t)
bytes are available in command before calling macho_handle_segment64().
The same issue occurs when calling macho_handle_segment(),
macho_handle_unixthread() and macho_handle_main().
{
case LC_SEGMENT:
+ if(command_struct.cmdsize < sizeof(yr_segment_command_32_t))
+ break;
macho_handle_segment(command, seg_count++, object);
break;
case LC_SEGMENT_64:
+ if(command_struct.cmdsize < sizeof(yr_segment_command_64_t))
+ break;
macho_handle_segment_64(command, seg_count++, object);
break;
}
{
case LC_UNIXTHREAD:
+ if(command_struct.cmdsize < sizeof(yr_thread_command_t))
+ break;
macho_handle_unixthread(command, object, context);
break;
case LC_MAIN:
+ if(command_struct.cmdsize < sizeof(yr_entry_point_command_t))
+ break;
macho_handle_main(command, object, context);
break;
}
}
Please note that we rely here on cmdsize having a safe value, which is
checked in the fix proposed for the previous finding.
Proof of Concept
----------------
Parse the
https://github.com/x41sec/advisories/tree/master/X41-2021-001/yara-reproducers/oob-macho-handle-segment,
https://github.com/x41sec/advisories/tree/master/X41-2021-001/yara-reproducers/oob-macho-handle-segment-64
samples via yr_rules_scan_mem().
Several out-of-bounds reads in macho_handle_unixthread()
========================================================
Severity Rating: Medium
Vector: Mach-O file sample
CVE: Pending
CWE: 125
Analysis
--------
macho_handle_unixthread() reads from command buffer without checking if
the buffer is big enough.
Firstly, sizeof(yr_thread_command_t) bytes are skipped in command,
command = (void*) ((uint8_t*) command + sizeof(yr_thread_command_t));
which could result in command pointing out of bounds and triggering
invalid reads in subsequent command dereferences. It is recommended
to check at least sizeof(yr_thread_command_t) bytes are available
before calling macho_handle_unixthread().
case LC_UNIXTHREAD:
+ if(size - (command - data) < sizeof(yr_thread_command_t))
+ break;
macho_handle_unixthread(command, object, context);
break;
Secondly, when reading the entry point for the different architectures,
it is
assumed the buffer is big enough to read the corresponding
yr_*_thread_state_t object. A not big enough buffer would lead to out
of bounds reads and maybe denial of service or infoleaks. It is
recommended to check at least enough bytes are available.
int should_swap = should_swap_bytes(get_integer(object, "magic"));
bool is64 = false;
uint32_t s = ((yr_thread_command_t*)command)->cmdsize -
sizeof(yr_thread_command_t);
command = (void*) ((uint8_t*) command + sizeof(yr_thread_command_t));
uint64_t address = 0;
switch (get_integer(object, "cputype"))
{
case CPU_TYPE_MC680X0:
{
+ if (s < sizeof(yr_m68k_thread_state_t))
+ break;
yr_m68k_thread_state_t* m68k_state = (yr_m68k_thread_state_t*) command;
address = m68k_state->pc;
break;
}
case CPU_TYPE_MC88000:
{
+ if (s < sizeof(yr_m88k_thread_state_t))
+ break;
yr_m88k_thread_state_t* m88k_state = (yr_m88k_thread_state_t*) command;
address = m88k_state->xip;
break;
}
case CPU_TYPE_SPARC:
{
+ if (s < sizeof(yr_sparc_thread_state_t))
+ break;
yr_sparc_thread_state_t* sparc_state = (yr_sparc_thread_state_t*)
command;
address = sparc_state->pc;
break;
}
case CPU_TYPE_POWERPC:
{
+ if (s < sizeof(yr_ppc_thread_state_t))
+ break;
yr_ppc_thread_state_t* ppc_state = (yr_ppc_thread_state_t*) command;
address = ppc_state->srr0;
break;
}
case CPU_TYPE_X86:
{
+ if (s < sizeof(yr_x86_thread_state_t))
+ break;
yr_x86_thread_state_t* x86_state = (yr_x86_thread_state_t*) command;
address = x86_state->eip;
break;
}
case CPU_TYPE_ARM:
{
+ if (s < sizeof(yr_arm_thread_state_t))
+ break;
yr_arm_thread_state_t* arm_state = (yr_arm_thread_state_t*) command;
address = arm_state->pc;
break;
}
case CPU_TYPE_X86_64:
{
+ if (s < sizeof(yr_x86_thread_state64_t))
+ break;
yr_x86_thread_state64_t* x64_state = (yr_x86_thread_state64_t*)
command;
address = x64_state->rip;
is64 = true;
}
case CPU_TYPE_ARM64:
{
+ if (s < sizeof(yr_arm_thread_state64_t))
+ break;
yr_arm_thread_state64_t* arm64_state = (yr_arm_thread_state64_t*)
command;
address = arm64_state->pc;
is64 = true;
}
case CPU_TYPE_POWERPC64:
{
+ if (s < sizeof(yr_ppc_thread_state64_t))
+ break;
yr_ppc_thread_state64_t* ppc64_state = (yr_ppc_thread_state64_t*)
command;
address = ppc64_state->srr0;
is64 = true;
Please note that we rely here on cmdsize having a safe value, which is
checked in one of the fixes proposed above.
Proof of Concept
-----------------
Parse the
https://github.com/x41sec/advisories/tree/master/X41-2021-001/yara-reproducers/oob-macho-handle-unixthread
sample via yr_rules_scan_mem().
Out-of-bounds read in macho_is_32()
===================================
Severity Rating: Medium
Vector: Mach-O file sample
CVE: Pending
CWE: 125
Analysis
---------
macho_parse_file() calls macho_is_32(data) without checking that size is at
least 4 bytes. An out of bounds read happens when size < 4. Depending on
the initial parsed file size, data buffer could come from a mmaped
region and the OOB read could lead to a denial of service.
It is recommended to return from the function when size < 4.
+ if (size < 4)
+ return;
+
size_t header_size = macho_is_32(data) ? sizeof(yr_mach_header_32_t)
: sizeof(yr_mach_header_64_t);
Proof of Concept
----------------
Parse the
https://github.com/x41sec/advisories/tree/master/X41-2021-001/yara-reproducers/oob-macho-is-32.v2
sample via yr_rules_scan_mem().
Timeline
========
2021-01-16 Issues found
2021-01-20 Issues and patches reported to the vendor
2021-01-21 Vendor reply with acknowledge and final patches
2021-01-22 CVEs request (pending)
2021-01-27 Fixed release (v4.0.4)
2021-01-28 Advisory published
About X41 D-SEC GmbH
====================
X41 is an expert provider for application security services.
Having extensive industry experience and expertise in the area of
information security, a strong core security team of world class
security experts enables X41 to perform premium security services.
Fields of expertise in the area of application security are security
centered code reviews, binary reverse engineering and vulnerability
discovery. Custom research and IT security consulting and support
services are core competencies of X41.
--------------2E5FE0556E296D780D47341F
Content-Type: text/plain; charset=UTF-8;
name="x41-2021-001-yara.txt"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="x41-2021-001-yara.txt"
WDQxIEQtU2VjIEdtYkggU2VjdXJpdHkgQWR2aXNvcnk6IFg0MS0yMDIxLTAwMQoKTXVsdGlw
bGUgVnVsbmVyYWJpbGl0aWVzIGluIFlBUkEKPT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT0KSGlnaGVzdCBTZXZlcml0eSBSYXRpbmc6IE1lZGl1bQpDb25maXJtZWQgQWZmZWN0
ZWQgVmVyc2lvbnM6ICBZQVJBIHY0LjAuMyBhbmQgZWFybGllcgpDb25maXJtZWQgUGF0Y2hl
ZCBWZXJzaW9uczogWUFSQSB2NC4wLjQKVmVuZG9yOiBWaXJ1c1RvdGFsIChHb29nbGUgSW5j
LikKVmVuZG9yIFVSTDogaHR0cHM6Ly92aXJ1c3RvdGFsLmdpdGh1Yi5pby95YXJhCkNyZWRp
dDogWDQxIEQtU2VjIEdtYkgsIEx1aXMgTWVyaW5vClN0YXR1czogUHVibGljCkFkdmlzb3J5
LVVSTDogaHR0cHM6Ly93d3cueDQxLWRzZWMuZGUvbGFiL2Fkdmlzb3JpZXMveDQxLTIwMjEt
MDAxLXlhcmEKCgpTdW1tYXJ5IGFuZCBJbXBhY3QKLS0tLS0tLS0tLS0tLS0tLS0tCkFuIGlu
dGVnZXIgb3ZlcmZsb3cgYW5kIHNldmVyYWwgYnVmZmVyIG92ZXJmbG93IHJlYWRzIGluCmxp
YnlhcmEvbW9kdWxlcy9tYWNoby9tYWNoby5jIGluIFlBUkEgdjQuMC4zIGFuZCBlYXJsaWVy
IGNvdWxkIGFsbG93IGFuCmF0dGFja2VyIHRvIGVpdGhlciBjYXVzZSBkZW5pYWwgb2Ygc2Vy
dmljZSBvciBpbmZvcm1hdGlvbiBkaXNjbG9zdXJlCnZpYSBhIG1hbGljaW91cyBNYWNoLU8g
ZmlsZS4KCgpQcm9kdWN0IERlc2NyaXB0aW9uCi0tLS0tLS0tLS0tLS0tLS0tLS0KQWNjb3Jk
aW5nIHRvIHRoZSBvZmZpY2lhbCBwcm9qZWN0IGRlc2NyaXB0aW9uOgoKCkludGVnZXIgb3Zl
cmZsb3cgaW4gbWFjaG9fcGFyc2VfZmF0X2ZpbGUoKQo9PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT0KU2V2ZXJpdHkgUmF0aW5nOiBNZWRpdW0KVmVjdG9yOiBN
YWNoLU8gZmlsZSBzYW1wbGUKQ1ZFOiBQZW5kaW5nCkNXRTogMTkwCgoKQW5hbHlzaXMKLS0t
LS0tLS0KQW4gaW50ZWdlciBvdmVyZmxvdyBpbiBtYWNob19wYXJzZV9mYXRfZmlsZSgpIHdo
aWxlIHByb2Nlc3NpbmcgdGhlCmZhdCBNYWNoLU8gZmlsZSBoZWFkZXIgY2FuIGxlYWQgdG8g
YXJiaXRyYXJ5IHJlYWQuCgogICAgaWYgKHNpemUgPCBhcmNoLm9mZnNldCArIGFyY2guc2l6
ZSkKICAgICAgY29udGludWU7CgogICAgLyogRm9yY2UgJ2ZpbGUnIGFycmF5IGVudHJ5IGNy
ZWF0aW9uLiAqLwogICAgc2V0X2ludGVnZXIoWVJfVU5ERUZJTkVELCBvYmplY3QsICJmaWxl
WyVpXS5tYWdpYyIsIGkpOwoKICAgIC8qIEdldCBzcGVjaWZpYyBNYWNoLU8gZmlsZSBkYXRh
LiAqLwogICAgbWFjaG9fcGFyc2VfZmlsZSgKICAgICAgICBkYXRhICsgYXJjaC5vZmZzZXQs
CiAgICAgICAgYXJjaC5zaXplLAogICAgICAgIGdldF9vYmplY3Qob2JqZWN0LCAiZmlsZVsl
aV0iLCBpKSwKICAgICAgICBjb250ZXh0KTsKCldoZW4gdGhlIGFyY2gub2Zmc2V0ICsgYXJj
aC5zaXplIHJlc3VsdCBkb2VzIG5vdCBmaXQgaW4gdGhlIHVpbnQ2NF90IHR5cGUKdGhlIHJl
c3VsdCB3aWxsIHdyYXAgYXJvdW5kIGFuZCBtaWdodCBhbGxvdyB0byBieXBhc3MgdGhlCnNp
emUgPCBhcmNoLm9mZnNldCArIGFyY2guc2l6ZSBzYW5pdHkgY2hlY2suIEFmdGVyd2FyZHMs
Cm1hY2hvX3BhcnNlX2ZpbGUoKSB3aWxsIGJlIGNhbGxlZCB3aXRoIGJ1ZmZlciBhbmQgc2l6
ZSB2YWx1ZXMgdGhhdApjb3VsZCBiZSBpbnZhbGlkLCByZXN1bHRpbmcgaW4gYXJiaXRyYXJ5
IHJlYWQgYW5kIHBsYXVzaWJsZSBpbmZvbGVha2FnZSBvciBhCmRlbmlhbCBvZiBzZXJ2aWNl
LgoKUHJvb2Ygb2YgQ29uY2VwdAotLS0tLS0tLS0tLS0tLS0tClBhcnNlIHRoZSBodHRwczov
L2dpdGh1Yi5jb20veDQxc2VjL2Fkdmlzb3JpZXMvdHJlZS9tYXN0ZXIvWDQxLTIwMjEtMDAx
L3lhcmEtcmVwcm9kdWNlcnMvaW50LW92ZXJmbG93LW1hY2hvLXBhcnNlLWZhdC1maWxlCnNh
bXBsZSB2aWEgeXJfcnVsZXNfc2Nhbl9tZW0oKS4KCgpPdXQtb2YtYm91bmRzIHJlYWRzIGlu
IG1hY2hvX3BhcnNlX2ZpbGUoKSBhbmQgb3RoZXJzCj09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KU2V2ZXJpdHkgUmF0aW5nOiBNZWRpdW0K
VmVjdG9yOiBNYWNoLU8gZmlsZSBzYW1wbGUKQ1ZFOiBQZW5kaW5nCkNXRTogMTI1CgoKQW5h
bHlzaXMKLS0tLS0tLS0KVHdvIGZvci1sb29wcyBpdGVyYXRlIG92ZXIgaW5wdXQgYnVmZmVy
IGRhdGEgdG8gZXh0cmFjdCBhbmQgcHJvY2VzcwpzZWdtZW50cyBhbmQgb3RoZXIgY29tbWFu
ZHMuIEluY29ycmVjdCBzYW5pdHkgY2hlY2tzIGxlYWQgdG8gb3V0IG9mCmJvdW5kcyByZWFk
cyBpbiBzZXZlcmFsIHBsYWNlcy4KCkl0IGlzIGFsc28gcmVjb21tZW5kZWQgdG8gcGVyZm9y
bSBhIHNhbml0eSBjaGVjayBvbgpjb21tYW5kX3N0cnVjdC5jbWRzaXplLCBkaXNjYXJkaW5n
IHRob3NlIHZhbHVlcyB3aGVyZQpjb21tYW5kX3N0cnVjdC5jbWRzaXplPHNpemVvZih5cl9s
b2FkX2NvbW1hbmRfdCkuCgogICBmb3IgKHVuc2lnbmVkIGkgPSAwOyBpIDwgaGVhZGVyLm5j
bWRzOyBpKyspCiAgIHsKLSAtICAgIGlmIChjb21tYW5kIC0gZGF0YSA8IHNpemVvZih5cl9s
b2FkX2NvbW1hbmRfdCkpCisgICAgaWYgKGRhdGEgKyBzaXplIDwgY29tbWFuZCArIHNpemVv
Zih5cl9sb2FkX2NvbW1hbmRfdCkpCiAgICAgICBicmVhazsKIAogICAgIG1lbWNweSgmY29t
bWFuZF9zdHJ1Y3QsIGNvbW1hbmQsIHNpemVvZih5cl9sb2FkX2NvbW1hbmRfdCkpOwoKICAg
IGlmIChzaG91bGRfc3dhcCkKICAgICAgc3dhcF9sb2FkX2NvbW1hbmQoJmNvbW1hbmRfc3Ry
dWN0KTsKCi0gLSAgICBpZiAoc2l6ZSA8IGhlYWRlcl9zaXplICsgY29tbWFuZF9zdHJ1Y3Qu
Y21kc2l6ZSkKKyAgICBpZiAoc2l6ZSAtIChjb21tYW5kIC0gZGF0YSkgPCBjb21tYW5kX3N0
cnVjdC5jbWRzaXplIHx8IGNvbW1hbmRfc3RydWN0LmNtZHNpemUgPCBzaXplb2YoeXJfbG9h
ZF9jb21tYW5kX3QpKQogICAgICAgYnJlYWs7CgpQbGVhc2Ugbm90ZSB0aGF0IHRoaXMgbmVl
ZHMgdG8gYmUgcGF0Y2hlZCBpbiB0aGUgdHdvIHNpbWlsYXIgZm9yLWxvb3BzLgoKClByb29m
IG9mIENvbmNlcHQKLS0tLS0tLS0tLS0tLS0tLQpQYXJzZSB0aGUgaHR0cHM6Ly9naXRodWIu
Y29tL3g0MXNlYy9hZHZpc29yaWVzL3RyZWUvbWFzdGVyL1g0MS0yMDIxLTAwMS95YXJhLXJl
cHJvZHVjZXJzL29vYi1tYWNoby1wYXJzZS1maWxlCnNhbXBsZSB2aWEgeXJfcnVsZXNfc2Nh
bl9tZW0oKS4KCgpPdXQtb2YtYm91bmRzIHJlYWRzIGluIG1hY2hvX2hhbmRsZV9zZWdtZW50
XzY0KCkgYW5kIG90aGVycwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PQpTZXZlcml0eSBSYXRpbmc6IE1lZGl1bQpWZWN0b3I6
IE1hY2gtTyBmaWxlIHNhbXBsZQpDVkU6IFBlbmRpbmcKQ1dFOiAxMjUKCgpBbmFseXNpcwot
LS0tLS0tLQptYWNob19oYW5kbGVfc2VnbWVudF82NCgpIHJlYWRzIHNpemVvZih5cl9zZWdt
ZW50X2NvbW1hbmRfNjRfdCkgYnl0ZXMKZnJvbSBjb21tYW5kIHdpdGhvdXQgY2hlY2tpbmcg
aWYgdGhlIGJ1ZmZlciBpcyBiaWcgZW5vdWdoLgoKICBtZW1jcHkoJnNnLCBjb21tYW5kLCBz
aXplb2YoeXJfc2VnbWVudF9jb21tYW5kXzY0X3QpKTsKClRoaXMgcmVzdWx0cyBpbiBhbiBv
dXQgb2YgYm91bmRzIHJlYWQgd2hlbiBjb21tYW5kIGlzIG5vdCBiaWcgZW5vdWdoLiBJbmZv
bGVhawpvciBkZW5pYWwgb2Ygc2VydmljZSBjb3VsZCBiZSBhIHBsYXVzaWJsZSBvdXRjb21l
LiAKCkl0IGlzIHJlY29tbWVuZGVkIHRvIGNoZWNrIGF0IGxlYXN0IHNpemVvZih5cl9zZWdt
ZW50X2NvbW1hbmRfNjRfdCkKYnl0ZXMgYXJlIGF2YWlsYWJsZSBpbiBjb21tYW5kIGJlZm9y
ZSBjYWxsaW5nIG1hY2hvX2hhbmRsZV9zZWdtZW50NjQoKS4KClRoZSBzYW1lIGlzc3VlIG9j
Y3VycyB3aGVuIGNhbGxpbmcgbWFjaG9faGFuZGxlX3NlZ21lbnQoKSwKbWFjaG9faGFuZGxl
X3VuaXh0aHJlYWQoKSBhbmQgbWFjaG9faGFuZGxlX21haW4oKS4KCnsKICAgICBjYXNlIExD
X1NFR01FTlQ6CisgICAgICBpZihjb21tYW5kX3N0cnVjdC5jbWRzaXplIDwgc2l6ZW9mKHly
X3NlZ21lbnRfY29tbWFuZF8zMl90KSkKKyAgICAgICAgYnJlYWs7CiAgICAgICBtYWNob19o
YW5kbGVfc2VnbWVudChjb21tYW5kLCBzZWdfY291bnQrKywgb2JqZWN0KTsKICAgICAgIGJy
ZWFrOwogICAgIGNhc2UgTENfU0VHTUVOVF82NDoKKyAgICAgIGlmKGNvbW1hbmRfc3RydWN0
LmNtZHNpemUgPCBzaXplb2YoeXJfc2VnbWVudF9jb21tYW5kXzY0X3QpKQorICAgICAgICBi
cmVhazsKICAgICAgIG1hY2hvX2hhbmRsZV9zZWdtZW50XzY0KGNvbW1hbmQsIHNlZ19jb3Vu
dCsrLCBvYmplY3QpOwogICAgICAgYnJlYWs7Cn0KCnsKICAgIGNhc2UgTENfVU5JWFRIUkVB
RDoKKyAgICAgaWYoY29tbWFuZF9zdHJ1Y3QuY21kc2l6ZSA8IHNpemVvZih5cl90aHJlYWRf
Y29tbWFuZF90KSkKKyAgICAgICAgIGJyZWFrOwogICAgICBtYWNob19oYW5kbGVfdW5peHRo
cmVhZChjb21tYW5kLCBvYmplY3QsIGNvbnRleHQpOwogICAgICBicmVhazsKICAgIGNhc2Ug
TENfTUFJTjoKKyAgICAgaWYoY29tbWFuZF9zdHJ1Y3QuY21kc2l6ZSA8IHNpemVvZih5cl9l
bnRyeV9wb2ludF9jb21tYW5kX3QpKQorICAgICAgICAgYnJlYWs7CiAgICAgIG1hY2hvX2hh
bmRsZV9tYWluKGNvbW1hbmQsIG9iamVjdCwgY29udGV4dCk7CiAgICAgIGJyZWFrOwogICAg
fQoKfQoKUGxlYXNlIG5vdGUgdGhhdCB3ZSByZWx5IGhlcmUgb24gY21kc2l6ZSBoYXZpbmcg
YSBzYWZlIHZhbHVlLCB3aGljaCBpcwpjaGVja2VkIGluIHRoZSBmaXggcHJvcG9zZWQgZm9y
IHRoZSBwcmV2aW91cyBmaW5kaW5nLgoKClByb29mIG9mIENvbmNlcHQKLS0tLS0tLS0tLS0t
LS0tLQpQYXJzZSB0aGUgaHR0cHM6Ly9naXRodWIuY29tL3g0MXNlYy9hZHZpc29yaWVzL3Ry
ZWUvbWFzdGVyL1g0MS0yMDIxLTAwMS95YXJhLXJlcHJvZHVjZXJzL29vYi1tYWNoby1oYW5k
bGUtc2VnbWVudCwKaHR0cHM6Ly9naXRodWIuY29tL3g0MXNlYy9hZHZpc29yaWVzL3RyZWUv
bWFzdGVyL1g0MS0yMDIxLTAwMS95YXJhLXJlcHJvZHVjZXJzL29vYi1tYWNoby1oYW5kbGUt
c2VnbWVudC02NApzYW1wbGVzIHZpYSB5cl9ydWxlc19zY2FuX21lbSgpLgoKClNldmVyYWwg
b3V0LW9mLWJvdW5kcyByZWFkcyBpbiBtYWNob19oYW5kbGVfdW5peHRocmVhZCgpCj09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09ClNl
dmVyaXR5IFJhdGluZzogTWVkaXVtClZlY3RvcjogTWFjaC1PIGZpbGUgc2FtcGxlCkNWRTog
UGVuZGluZwpDV0U6IDEyNQoKCkFuYWx5c2lzCi0tLS0tLS0tCm1hY2hvX2hhbmRsZV91bml4
dGhyZWFkKCkgcmVhZHMgZnJvbSBjb21tYW5kIGJ1ZmZlciB3aXRob3V0IGNoZWNraW5nIGlm
CnRoZSBidWZmZXIgaXMgYmlnIGVub3VnaC4KCkZpcnN0bHksIHNpemVvZih5cl90aHJlYWRf
Y29tbWFuZF90KSBieXRlcyBhcmUgc2tpcHBlZCBpbiBjb21tYW5kLAoKICBjb21tYW5kID0g
KHZvaWQqKSAoKHVpbnQ4X3QqKSBjb21tYW5kICsgc2l6ZW9mKHlyX3RocmVhZF9jb21tYW5k
X3QpKTsKCndoaWNoIGNvdWxkIHJlc3VsdCBpbiBjb21tYW5kIHBvaW50aW5nIG91dCBvZiBi
b3VuZHMgYW5kIHRyaWdnZXJpbmcKaW52YWxpZCByZWFkcyBpbiBzdWJzZXF1ZW50IGNvbW1h
bmQgZGVyZWZlcmVuY2VzLiBJdCBpcyByZWNvbW1lbmRlZAp0byBjaGVjayBhdCBsZWFzdCBz
aXplb2YoeXJfdGhyZWFkX2NvbW1hbmRfdCkgYnl0ZXMgYXJlIGF2YWlsYWJsZQpiZWZvcmUg
Y2FsbGluZyBtYWNob19oYW5kbGVfdW5peHRocmVhZCgpLgoKICAgIGNhc2UgTENfVU5JWFRI
UkVBRDoKKyAgICAgaWYoc2l6ZSAtIChjb21tYW5kIC0gZGF0YSkgPCBzaXplb2YoeXJfdGhy
ZWFkX2NvbW1hbmRfdCkpCisgICAgICAgICBicmVhazsKICAgICAgbWFjaG9faGFuZGxlX3Vu
aXh0aHJlYWQoY29tbWFuZCwgb2JqZWN0LCBjb250ZXh0KTsKICAgICAgYnJlYWs7CgpTZWNv
bmRseSwgd2hlbiByZWFkaW5nIHRoZSBlbnRyeSBwb2ludCBmb3IgdGhlIGRpZmZlcmVudCBh
cmNoaXRlY3R1cmVzLCBpdCBpcwphc3N1bWVkIHRoZSBidWZmZXIgaXMgYmlnIGVub3VnaCB0
byByZWFkIHRoZSBjb3JyZXNwb25kaW5nCnlyXypfdGhyZWFkX3N0YXRlX3Qgb2JqZWN0LiBB
IG5vdCBiaWcgZW5vdWdoIGJ1ZmZlciB3b3VsZCBsZWFkIHRvIG91dApvZiBib3VuZHMgcmVh
ZHMgYW5kIG1heWJlIGRlbmlhbCBvZiBzZXJ2aWNlIG9yIGluZm9sZWFrcy4gSXQgaXMKcmVj
b21tZW5kZWQgdG8gY2hlY2sgYXQgbGVhc3QgZW5vdWdoIGJ5dGVzIGFyZSBhdmFpbGFibGUu
CgogIGludCBzaG91bGRfc3dhcCA9IHNob3VsZF9zd2FwX2J5dGVzKGdldF9pbnRlZ2VyKG9i
amVjdCwgIm1hZ2ljIikpOwogIGJvb2wgaXM2NCA9IGZhbHNlOwogIHVpbnQzMl90IHMgPSAo
KHlyX3RocmVhZF9jb21tYW5kX3QqKWNvbW1hbmQpLT5jbWRzaXplIC0gc2l6ZW9mKHlyX3Ro
cmVhZF9jb21tYW5kX3QpOwogIGNvbW1hbmQgPSAodm9pZCopICgodWludDhfdCopIGNvbW1h
bmQgKyBzaXplb2YoeXJfdGhyZWFkX2NvbW1hbmRfdCkpOwogIHVpbnQ2NF90IGFkZHJlc3Mg
PSAwOwoKICBzd2l0Y2ggKGdldF9pbnRlZ2VyKG9iamVjdCwgImNwdXR5cGUiKSkKICB7CiAg
IGNhc2UgQ1BVX1RZUEVfTUM2ODBYMDoKICAgeworICAgIGlmIChzIDwgc2l6ZW9mKHlyX202
OGtfdGhyZWFkX3N0YXRlX3QpKQorICAgICAgYnJlYWs7CiAgICAgeXJfbTY4a190aHJlYWRf
c3RhdGVfdCogbTY4a19zdGF0ZSA9ICh5cl9tNjhrX3RocmVhZF9zdGF0ZV90KikgY29tbWFu
ZDsKICAgICBhZGRyZXNzID0gbTY4a19zdGF0ZS0+cGM7CiAgICAgYnJlYWs7CiAgIH0KICAg
Y2FzZSBDUFVfVFlQRV9NQzg4MDAwOgogICB7CisgICAgaWYgKHMgPCBzaXplb2YoeXJfbTg4
a190aHJlYWRfc3RhdGVfdCkpCisgICAgICBicmVhazsKICAgICB5cl9tODhrX3RocmVhZF9z
dGF0ZV90KiBtODhrX3N0YXRlID0gKHlyX204OGtfdGhyZWFkX3N0YXRlX3QqKSBjb21tYW5k
OwogICAgIGFkZHJlc3MgPSBtODhrX3N0YXRlLT54aXA7CiAgICAgYnJlYWs7CiAgIH0KICAg
Y2FzZSBDUFVfVFlQRV9TUEFSQzoKICAgeworICAgIGlmIChzIDwgc2l6ZW9mKHlyX3NwYXJj
X3RocmVhZF9zdGF0ZV90KSkKKyAgICAgIGJyZWFrOwogICAgIHlyX3NwYXJjX3RocmVhZF9z
dGF0ZV90KiBzcGFyY19zdGF0ZSA9ICh5cl9zcGFyY190aHJlYWRfc3RhdGVfdCopIGNvbW1h
bmQ7CiAgICAgYWRkcmVzcyA9IHNwYXJjX3N0YXRlLT5wYzsKICAgICBicmVhazsKICAgfQog
ICBjYXNlIENQVV9UWVBFX1BPV0VSUEM6CiAgIHsKKyAgICBpZiAocyA8IHNpemVvZih5cl9w
cGNfdGhyZWFkX3N0YXRlX3QpKQorICAgICAgYnJlYWs7CiAgICAgeXJfcHBjX3RocmVhZF9z
dGF0ZV90KiBwcGNfc3RhdGUgPSAoeXJfcHBjX3RocmVhZF9zdGF0ZV90KikgY29tbWFuZDsK
ICAgICBhZGRyZXNzID0gcHBjX3N0YXRlLT5zcnIwOwogICAgIGJyZWFrOwogICB9CiAgIGNh
c2UgQ1BVX1RZUEVfWDg2OgogICB7CisgICAgaWYgKHMgPCBzaXplb2YoeXJfeDg2X3RocmVh
ZF9zdGF0ZV90KSkKKyAgICAgIGJyZWFrOwogICAgIHlyX3g4Nl90aHJlYWRfc3RhdGVfdCog
eDg2X3N0YXRlID0gKHlyX3g4Nl90aHJlYWRfc3RhdGVfdCopIGNvbW1hbmQ7CiAgICAgYWRk
cmVzcyA9IHg4Nl9zdGF0ZS0+ZWlwOwogICAgIGJyZWFrOwogICB9CiAgIGNhc2UgQ1BVX1RZ
UEVfQVJNOgogICB7CisgICAgaWYgKHMgPCBzaXplb2YoeXJfYXJtX3RocmVhZF9zdGF0ZV90
KSkKKyAgICAgIGJyZWFrOwogICAgIHlyX2FybV90aHJlYWRfc3RhdGVfdCogYXJtX3N0YXRl
ID0gKHlyX2FybV90aHJlYWRfc3RhdGVfdCopIGNvbW1hbmQ7CiAgICAgYWRkcmVzcyA9IGFy
bV9zdGF0ZS0+cGM7CiAgICAgYnJlYWs7CiAgIH0KICAgY2FzZSBDUFVfVFlQRV9YODZfNjQ6
CiAgIHsKKyAgICBpZiAocyA8IHNpemVvZih5cl94ODZfdGhyZWFkX3N0YXRlNjRfdCkpCisg
ICAgICBicmVhazsKICAgICB5cl94ODZfdGhyZWFkX3N0YXRlNjRfdCogeDY0X3N0YXRlID0g
KHlyX3g4Nl90aHJlYWRfc3RhdGU2NF90KikgY29tbWFuZDsKICAgICBhZGRyZXNzID0geDY0
X3N0YXRlLT5yaXA7CiAgICAgaXM2NCA9IHRydWU7CiAgIH0KICAgY2FzZSBDUFVfVFlQRV9B
Uk02NDoKICAgeworICAgIGlmIChzIDwgc2l6ZW9mKHlyX2FybV90aHJlYWRfc3RhdGU2NF90
KSkKKyAgICAgIGJyZWFrOwogICAgIHlyX2FybV90aHJlYWRfc3RhdGU2NF90KiBhcm02NF9z
dGF0ZSA9ICh5cl9hcm1fdGhyZWFkX3N0YXRlNjRfdCopIGNvbW1hbmQ7CiAgICAgYWRkcmVz
cyA9IGFybTY0X3N0YXRlLT5wYzsKICAgICBpczY0ID0gdHJ1ZTsKICAgfQogICBjYXNlIENQ
VV9UWVBFX1BPV0VSUEM2NDoKICAgeworICAgIGlmIChzIDwgc2l6ZW9mKHlyX3BwY190aHJl
YWRfc3RhdGU2NF90KSkKKyAgICAgIGJyZWFrOwogICAgIHlyX3BwY190aHJlYWRfc3RhdGU2
NF90KiBwcGM2NF9zdGF0ZSA9ICh5cl9wcGNfdGhyZWFkX3N0YXRlNjRfdCopIGNvbW1hbmQ7
CiAgICAgYWRkcmVzcyA9IHBwYzY0X3N0YXRlLT5zcnIwOwogICAgIGlzNjQgPSB0cnVlOwoK
UGxlYXNlIG5vdGUgdGhhdCB3ZSByZWx5IGhlcmUgb24gY21kc2l6ZSBoYXZpbmcgYSBzYWZl
IHZhbHVlLCB3aGljaCBpcwpjaGVja2VkIGluIG9uZSBvZiB0aGUgZml4ZXMgcHJvcG9zZWQg
YWJvdmUuCgpQcm9vZiBvZiBDb25jZXB0Ci0tLS0tLS0tLS0tLS0tLS0tClBhcnNlIHRoZSBo
dHRwczovL2dpdGh1Yi5jb20veDQxc2VjL2Fkdmlzb3JpZXMvdHJlZS9tYXN0ZXIvWDQxLTIw
MjEtMDAxL3lhcmEtcmVwcm9kdWNlcnMvb29iLW1hY2hvLWhhbmRsZS11bml4dGhyZWFkCnNh
bXBsZSB2aWEgeXJfcnVsZXNfc2Nhbl9tZW0oKS4KCgpPdXQtb2YtYm91bmRzIHJlYWQgaW4g
bWFjaG9faXNfMzIoKQo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQpTZXZl
cml0eSBSYXRpbmc6IE1lZGl1bQpWZWN0b3I6IE1hY2gtTyBmaWxlIHNhbXBsZQpDVkU6IFBl
bmRpbmcKQ1dFOiAxMjUKCgpBbmFseXNpcwotLS0tLS0tLS0KbWFjaG9fcGFyc2VfZmlsZSgp
IGNhbGxzIG1hY2hvX2lzXzMyKGRhdGEpIHdpdGhvdXQgY2hlY2tpbmcgdGhhdCBzaXplIGlz
IGF0CmxlYXN0IDQgYnl0ZXMuIEFuIG91dCBvZiBib3VuZHMgcmVhZCBoYXBwZW5zIHdoZW4g
c2l6ZSA8IDQuIERlcGVuZGluZyBvbgp0aGUgaW5pdGlhbCBwYXJzZWQgZmlsZSBzaXplLCBk
YXRhIGJ1ZmZlciBjb3VsZCBjb21lIGZyb20gYSBtbWFwZWQKcmVnaW9uIGFuZCB0aGUgT09C
IHJlYWQgY291bGQgbGVhZCB0byBhIGRlbmlhbCBvZiBzZXJ2aWNlLgoKSXQgaXMgcmVjb21t
ZW5kZWQgdG8gcmV0dXJuIGZyb20gdGhlIGZ1bmN0aW9uIHdoZW4gc2l6ZSA8IDQuCgorICBp
ZiAoc2l6ZSA8IDQpCisgICAgcmV0dXJuOworCiAgIHNpemVfdCBoZWFkZXJfc2l6ZSA9IG1h
Y2hvX2lzXzMyKGRhdGEpID8gc2l6ZW9mKHlyX21hY2hfaGVhZGVyXzMyX3QpCiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDogc2l6ZW9mKHlyX21hY2hfaGVh
ZGVyXzY0X3QpOwoKClByb29mIG9mIENvbmNlcHQKLS0tLS0tLS0tLS0tLS0tLQpQYXJzZSB0
aGUgaHR0cHM6Ly9naXRodWIuY29tL3g0MXNlYy9hZHZpc29yaWVzL3RyZWUvbWFzdGVyL1g0
MS0yMDIxLTAwMS95YXJhLXJlcHJvZHVjZXJzL29vYi1tYWNoby1pcy0zMi52MgpzYW1wbGUg
dmlhIHlyX3J1bGVzX3NjYW5fbWVtKCkuCgoKVGltZWxpbmUKPT09PT09PT0KMjAyMS0wMS0x
NiBJc3N1ZXMgZm91bmQKMjAyMS0wMS0yMCBJc3N1ZXMgYW5kIHBhdGNoZXMgcmVwb3J0ZWQg
dG8gdGhlIHZlbmRvcgoyMDIxLTAxLTIxIFZlbmRvciByZXBseSB3aXRoIGFja25vd2xlZGdl
IGFuZCBmaW5hbCBwYXRjaGVzCjIwMjEtMDEtMjIgQ1ZFcyByZXF1ZXN0IChwZW5kaW5nKQoy
MDIxLTAxLTI3IEZpeGVkIHJlbGVhc2UgKHY0LjAuNCkKMjAyMS0wMS0yOCBBZHZpc29yeSBw
dWJsaXNoZWQKCkFib3V0IFg0MSBELVNFQyBHbWJICj09PT09PT09PT09PT09PT09PT09Clg0
MSBpcyBhbiBleHBlcnQgcHJvdmlkZXIgZm9yIGFwcGxpY2F0aW9uIHNlY3VyaXR5IHNlcnZp
Y2VzLgpIYXZpbmcgZXh0ZW5zaXZlIGluZHVzdHJ5IGV4cGVyaWVuY2UgYW5kIGV4cGVydGlz
ZSBpbiB0aGUgYXJlYSBvZiBpbmZvcm1hdGlvbgpzZWN1cml0eSwgYSBzdHJvbmcgY29yZSBz
ZWN1cml0eSB0ZWFtIG9mIHdvcmxkIGNsYXNzIHNlY3VyaXR5IGV4cGVydHMgZW5hYmxlcwpY
NDEgdG8gcGVyZm9ybSBwcmVtaXVtIHNlY3VyaXR5IHNlcnZpY2VzLgpGaWVsZHMgb2YgZXhw
ZXJ0aXNlIGluIHRoZSBhcmVhIG9mIGFwcGxpY2F0aW9uIHNlY3VyaXR5IGFyZSBzZWN1cml0
eSBjZW50ZXJlZApjb2RlIHJldmlld3MsIGJpbmFyeSByZXZlcnNlIGVuZ2luZWVyaW5nIGFu
ZCB2dWxuZXJhYmlsaXR5IGRpc2NvdmVyeS4KQ3VzdG9tIHJlc2VhcmNoIGFuZCBJVCBzZWN1
cml0eSBjb25zdWx0aW5nIGFuZCBzdXBwb3J0IHNlcnZpY2VzIGFyZSBjb3JlCmNvbXBldGVu
Y2llcyBvZiBYNDEuCg==
--------------2E5FE0556E296D780D47341F
Content-Type: text/plain; charset=UTF-8;
name="x41-2021-001-yara.txt.asc"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="x41-2021-001-yara.txt.asc"
LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KCmlRSkxCQUFCQ2dBMUZpRUVwd3hWVGd4
QUljVXZUdWdJbzVLbHBnNTBDeEFGQW1BVDJFNFhIR0ZrZG1semIzSnAKWlhOQWVEUXhMV1J6
WldNdVpHVUFDZ2tRbzVLbHBnNTBDeENRZFEvK09xdWlab2hXck5ZQnVMckxkTWpNb3VIYwp1
YUZxZTI5K1lWWE45ZFltNUpTaHd3QmxiV25RcFlwWEZJN2R0L0NyL0dXVWdvUytoc1NFKzJ1
REEvcllYRThGClJKMzVJOFRxZlJydEU5ZmEvWXJuenc1QlNjcDk2OW9tNG9DRzZWL0o5ZitU
bW1zWU8xL2hRcVFIUlBIOHBUOVYKaE1FMmloRTZxSG5qVXpUd1Z5cEtZNHhkWWZwc0Z1VmRW
VjZUZXR3d2V0eVNvaWRIU2ZOWlE3eXY1c0ZQcE9UbwpBQ01PdXh2K25PNjdnNHlYdFhiWURH
REU0WnlVcEVBbFJhZXNOVUR4VkU1d09FdFpyWW0vVW5hNzR4QzUwbXMvCkd4bVE0ZWo1aklx
dUFUTTUrajl5ekdrK1h2cDdNQ0hmdTRzdjJZTGdsNkNZbm85V3o3MFZ5bzdyOEMrbHN4bXcK
aVdpL0xuZE5za1kvRXhSSXdtbDBmbkZaMHVjbmx4VTJpSDVjV1FSRXRyVGQ2RHpob0NKblMx
cmt3MHE3RFFGbgo0Sy9BZHAzNjR2VjE3RkdZT3g2eHhEb0ovaC9MOENVZEdIV3NHek0xWlRR
LzliU3BVU0pJaHUrOWtlZFJTVVNFCkxFMmlzM085YmhuOWkzZ3pOeGtsMFk2VklXeEZ1T3or
RU9YdUlPVGZucVJDL21ORUFhQ1M5SVJhRHM0V0NvV2oKemhYaFpQanRLanRCeXMrakd2amFk
VVBLZjFCVHZ0SFZaWU9PYmNrWUE0U1BNaW5rRW04aEszVFRqRVV6dnc4bQpLMVVWNlMyZkNj
S0F1VHBOOUl4MGI4SDNzbGUxSjVncEVSaVduRTJseUw4bDZIMm1yRDNNbVJROEFqV2czMWtS
CnMzRE4zL0h5anpUTVZCTGYybDg9Cj05SWl5Ci0tLS0tRU5EIFBHUCBTSUdOQVRVUkUtLS0t
LQo=
--------------2E5FE0556E296D780D47341F
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline