Re: [PATCH] Match line update for Famatech Radmin remote control

[Brandon Enright <bmenrigh () ucsd edu>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, 10 Jun 2009 06:36:58 -0500 or thereabouts Tom Sellers
<nmap () fadedcode net> wrote:

> Brandon Enright wrote:
> > Hey Tom, this patch looks really good but before I check it in, I
> > have a question about the softmatch.
> >
> > Is "m|^\x01\x00\x00\x00\x25|" broken?  Your change to
> > "m|^\x01\x00\x00\x00.{3}\x02\x12\x08\x02|" is a lot more specific.
> > Is there a case where the original would match but your change
> > won't?
>
> Thanks for catching the mistake Brandon!
>
> How embarrassing to attempt to fix a match line only to botch it.
> The original softmatch line would fail on Radmin 3.x, the new one
> would not, had it been correct.

Don't worry about it, all of us who work on nmap-service-probes make
a lot of them. Something about trying to construct fast, generic regular
expressions from limited data seems to encourage mistakes ;-)

> A better softmatch would be:
>
> softmatch radmin m|^\x01\x00\x00\x00.{5}\x08.\x00| p/Famatech Radmin/
> o/Windows/

I started counting bytes and trying to decide if this was a good
match.  It seems to work it would need to be ".{4}", not 5.

> If you think that the line is too generic I can alter it to include
> options for the two values I have seen at position 8 (x01 and x02), 9
> (x10 and x12) and 11 (x01 and x02).  My concern is that a new minor
> release would come out and change those fields, breaking the
> softmatch.

I wouldn't say it's too generic, it just doesn't capture the structure
to what is changing very well.  I'd propose changing it to:

softmatch radmin m|^\x01\x00\x00\x00\x25.\x00..\x08.\x00..| p/Famatech Radmin/ o/Windows/

Also, I noticed your new match lines use ASCII where possible even
though the old matches do things like \x79 instead of 'y'.  I converted
your match lines over to escaped bytes because I think it makes the
field numbers a lot more obvious between different matches.

Attached is a new patch with my proposed changes.  If you think it will
work well I'll go ahead and check it in.

Regards,

Brandon

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.11 (GNU/Linux)

iEYEARECAAYFAkov4pMACgkQqaGPzAsl94LHSACgiR3DK/8155VPvpTKZBljGUO2
hmkAn3wIPfiz+3eie1fWMWbjH8nlew+C
=9zcR
-----END PGP SIGNATURE-----

Attachment: radmin.diff
Description:

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org