This update to NAFT adds support for YARA. YARA rules can be used to search through the heap, like this:
naft-icd.py -y IOS_canary.yara –decoders decoder_xor1 heap r870-core
Address Bytes Prev Next Ref PrevF NextF Alloc PC what 83AB9498 0000004100 83AB9444 83ABA4CC 001 -------- -------- 80B5CC7C 8253709C YARA rule: IOS_canary
Rule IOS_canary.yara searches for a canary value inside the blocks.
rule IOS_canary
{
strings:
$canary = {FD 01 10 DF}
condition:
$canary
}
NAFT_V0_0_9.zip (https)
MD5: FEBBDB892D631275A95A0FEA59F8519F
SHA256: 95F42F109623F2BA6D8A9FFB013CBB0B5E995F02E5EB35F8E83A62B8CA8B86D0
Didier Stevens 