AUTRUN.INF starts with a comment line ";" instead [autorun] (#16983)

Here you can provide suggestions on how to improve the product, website, etc.

AUTRUN.INF starts with a comment line ";" instead [autorun] (#16983)

Postby j2j » 28. Jul 2017, 12:09


Mod edit: related ticket, #16983: Autorun.inf not correctly identified from 'file' command.

Hello,

The AUTORUN.INF included in VirtualBox VBoxGuestAdditions CD 5.1.24 and earlier
starts with a comment line. That is a line that starts with a semicolon at the
beginning. So AUTRUN.INF looks like:

;
; Copyright (C) 2006-2016 Oracle Corporation
;
[autorun]
open=VBoxWindowsAdditions.exe

For a INF or INI file interpreter such line order does not matter, but for
other tools this can be annoying.

The newest file(1) command version identifies examples correct as "Microsoft Windows Autorun file".
Also the file identifier tool TrID with newest definition dated about end of July 2017
identify now your AUTORUN.INF.
But these tools need additional rules to recognize this AUTORUN.INF variant.

So more CPU power and time is needed when scanning file collections. That is a
problem when you try to identify or classify files fast and reliable in times
of more virus startups like wannacry.

So it would be nice if your INF file could start with the low case text
"[autorun]" immediately followed by a DOS line feed "CRLF" after right bracket
"]". With this byte sequence 5B6175746F72756E5D used as magic number it is
easier or faster for above mentioned tools to identify AUTRUN files.

I hope that my recommendation concerning AUTORUN files can be applied for your
used example.

Thanks,
j2j
Last edited by socratis on 6. Aug 2017, 08:49, edited 1 time in total.
Reason: Added ticket related information.
j2j
 
Posts: 1
Joined: 28. Jul 2017, 11:54

Re: AUTRUN.INF starts with a comment line ";" instead [autorun]

Postby mpack » 28. Jul 2017, 12:21

Let's get this clear... You want to the devs to modify VirtualBox to accomodate broken third party parsers??
mpack
Site Moderator
 
Posts: 25455
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: AUTRUN.INF starts with a comment line ";" instead [autorun]

Postby socratis » 28. Jul 2017, 13:57

It's not that intrusive of a change IMHO. If it helps others work right, I don't see a reason why moving a comment block below the execution block is such a big sacrifice. Here's the file in question (/vbox/src/VBox/Additions/WINNT/Installer/ISO/AUTORUN.INF):
Code: Select all   Expand viewCollapse view
;
; Copyright (C) 2006-2016 Oracle Corporation
;
; This file is part of VirtualBox Open Source Edition (OSE), as
; available from http://www.virtualbox.org. This file is free software;
; you can redistribute it and/or modify it under the terms of the GNU
; General Public License (GPL) as published by the Free Software
; Foundation, in version 2 as it comes in the "COPYING" file of the
; VirtualBox OSE distribution. VirtualBox OSE is distributed in the
; hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
;

[autorun]
open=VBoxWindowsAdditions.exe
icon=VBoxWindowsAdditions.exe
label=VirtualBox Guest Additions

You move the comments below the actions and everybody lives happily ever after...
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
socratis
Site Moderator
 
Posts: 12621
Joined: 22. Oct 2010, 11:03
Location: Greece
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5

Re: AUTRUN.INF starts with a comment line ";" instead [autorun]

Postby scottgus1 » 28. Jul 2017, 14:27

For what it's worth, this page from Microsoft: Autorun.inf Entries has the autorun tag spelled "[AutoRun]" Camel-Case-Style, not all lowercase. I'd suspect that this spelling would not fit the string suggested by the OP.
running version 5.1.6 & 5.0.24
Human government is like that crazy uncle who hides a quarter in his fist behind his back, then asks you to guess which fist the quarter is in...
No matter which side you choose, Left or Right, both Sides are empty.
scottgus1
 
Posts: 3455
Joined: 30. Dec 2009, 20:14
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: XP SBS2003 Win7

Re: AUTRUN.INF starts with a comment line ";" instead [autorun]

Postby mpack » 28. Jul 2017, 16:25

Precisely. If you're going to make allowances for broken parsers, why stop with this?

And which "other tools" are we talking about anyway? The only tools which need to read autorun.inf are text editors and OS boot code. And the latter shouldn't need any help from the VirtualBox devs to parse a valid file.
mpack
Site Moderator
 
Posts: 25455
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: AUTRUN.INF starts with a comment line ";" instead [autorun]

Postby socratis » 28. Jul 2017, 17:00

mpack wrote:And which "other tools" are we talking about anyway?

He gave a really prominent example: "file". That's a standard tool in Unix-like systems (part of the Single Unix Specification actually) which quickly identifies a lot of file types, based on their signature. Example:
Code: Select all   Expand viewCollapse view
$ file /Users/Shared/VirtualBox/Source/vbox/src/VBox/Additions/WINNT/Installer/ISO/AUTORUN.INF
AUTORUN.INF: ASCII English text, with CRLF line terminators

After the proposed change however:
Code: Select all   Expand viewCollapse view
$ file /Users/Shared/VirtualBox/Source/vbox/src/VBox/Additions/WINNT/Installer/ISO/AUTORUN.INF
AUTORUN.INF: Microsoft Windows Autorun file.

And yes Scott, it covers CamelCase as well... ;)
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
socratis
Site Moderator
 
Posts: 12621
Joined: 22. Oct 2010, 11:03
Location: Greece
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5

Re: AUTRUN.INF starts with a comment line ";" instead [autorun]

Postby scottgus1 » 28. Jul 2017, 17:20

Interesting command! It didn't jump out at me in the OP, I didn't notice it.

Sounds like he's trying to cobble together a ransomware detector or stopper, and attempting to develop signatures for common files.

My thought about the CamelCase was to show that the hex string listed in the first post for an autorun signature matches his lowercase [autorun] but not Microsoft's [AutoRun], so another rule at least would be needed anyway.

FWIW, j2j, how many Guest Additions ISO's would there usually be on a PC? Typically one, unless one keeps older version installers about. Then there'd be maybe three, four, etc. I wouldn't imagine that there'd be that much processing power lost checking one file, even three or four.
running version 5.1.6 & 5.0.24
Human government is like that crazy uncle who hides a quarter in his fist behind his back, then asks you to guess which fist the quarter is in...
No matter which side you choose, Left or Right, both Sides are empty.
scottgus1
 
Posts: 3455
Joined: 30. Dec 2009, 20:14
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: XP SBS2003 Win7

Re: AUTRUN.INF starts with a comment line ";" instead [autorun] (#16983)

Postby socratis » 6. Aug 2017, 08:51

If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
socratis
Site Moderator
 
Posts: 12621
Joined: 22. Oct 2010, 11:03
Location: Greece
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5

Re: AUTRUN.INF starts with a comment line ";" instead [autorun] (#16983)

Postby michaln » 7. Aug 2017, 14:15

Did you also open a bug for the 'file' command?

Seriously, if you are using a broken tool, that is your problem, not Oracle's.
michaln
Oracle Corporation
 
Posts: 2841
Joined: 19. Dec 2007, 15:45
Primary OS: MS Windows 7
VBox Version: PUEL
Guest OSses: Any and all

Re: AUTRUN.INF starts with a comment line ";" instead [autorun] (#16983)

Postby socratis » 7. Aug 2017, 16:13

I wouldn't go as far as calling 'file' a broken tool. That's a bit.. too much, don't you think, given the fact that it's included with every Unix distribution out there (and not only the traditional ones) and it's part of the Single Unix Specification (IEEE Std 1003.1-2008, 2016 Edition)? A "broken tool" in a standard? I'd say quite the opposite.

And as for the bug report, try to see in as an improvement. I'm definitely against too many bug reports and my typical response is to sway people away from the bug tracker and towards the forums (as you may have noticed in the bug tracker). But 1) I wanted to let the OP know, and 2) I've seen trivial things often discussed and forgotten.

But, as they say in my hometown, "you have the watermelon, but you also have the knife", or in loose translation "it's entirely up to you, I can't do too much about it"... ;)
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
socratis
Site Moderator
 
Posts: 12621
Joined: 22. Oct 2010, 11:03
Location: Greece
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5

Re: AUTRUN.INF starts with a comment line ";" instead [autorun] (#16983)

Postby michaln » 7. Aug 2017, 17:38

The point is that the format of AUTORUN.INF is not defined by the 'file' utility, it is defined by Microsoft. Does Microsoft accept comments? Everything points to the answer being "yes". So why doesn't 'file'?

I didn't mean to say that 'file' as a whole is broken. But it's not perfect. Here's what happened to me today:

Code: Select all   Expand viewCollapse view
Michals-MacBook-Pro:logs michaln$ file ~/Desktop/Sierra.dmg
/Users/michaln/Desktop/Sierra.dmg: VAX COFF executable not stripped - version 18354

Should I complain to Apple and ask them to please create their DMG files so that they're not misidentified as VAX COFF executables by 'file'?
michaln
Oracle Corporation
 
Posts: 2841
Joined: 19. Dec 2007, 15:45
Primary OS: MS Windows 7
VBox Version: PUEL
Guest OSses: Any and all

Re: AUTRUN.INF starts with a comment line ";" instead [autorun] (#16983)

Postby socratis » 7. Aug 2017, 17:45

michaln wrote:Should I complain to Apple and ask them to please create their DMG files so that they're not misidentified as VAX COFF executables by 'file'?

Are you sure you don't have a corrupt download? :lol:
No, of course I wasn't trying to say that the 'file' is 100% false-positive free. Nor that comments are not allowed in Autorun.inf, on the contrary. But, if a simple one-line change makes a user happier without breaking at all VirtualBox, why not? That's all...

I should have characterized the ticket as an "Enhancement". ;)
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
socratis
Site Moderator
 
Posts: 12621
Joined: 22. Oct 2010, 11:03
Location: Greece
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5

Re: AUTRUN.INF starts with a comment line ";" instead [autorun] (#16983)

Postby mpack » 8. Aug 2017, 09:10

I would be against this change. Moving a comment into an option section of an INF (or INI) implies that the comment only applies in that section. If it applies to the entire file then it should be at the top, exactly where it is now.

And anyway, which other broken parsers should we accomodate with a minor tweak? It's a slippery slope.

I'd say: file a bug report on an appropriate forum for "file".
mpack
Site Moderator
 
Posts: 25455
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP


Return to Suggestions

Who is online

Users browsing this forum: No registered users and 2 guests