AUTRUN.INF starts with a comment line ";" instead [autorun] (#16983)

Here you can provide suggestions on how to improve the product, website, etc.
Post Reply
j2j
Posts: 1
Joined: 28. Jul 2017, 11:54

AUTRUN.INF starts with a comment line ";" instead [autorun] (#16983)

Post by j2j »


Mod edit: related ticket, #16983: Autorun.inf not correctly identified from 'file' command.
Hello,

The AUTORUN.INF included in VirtualBox VBoxGuestAdditions CD 5.1.24 and earlier
starts with a comment line. That is a line that starts with a semicolon at the
beginning. So AUTRUN.INF looks like:

;
; Copyright (C) 2006-2016 Oracle Corporation
;
[autorun]
open=VBoxWindowsAdditions.exe

For a INF or INI file interpreter such line order does not matter, but for
other tools this can be annoying.

The newest file(1) command version identifies examples correct as "Microsoft Windows Autorun file".
Also the file identifier tool TrID with newest definition dated about end of July 2017
identify now your AUTORUN.INF.
But these tools need additional rules to recognize this AUTORUN.INF variant.

So more CPU power and time is needed when scanning file collections. That is a
problem when you try to identify or classify files fast and reliable in times
of more virus startups like wannacry.

So it would be nice if your INF file could start with the low case text
"[autorun]" immediately followed by a DOS line feed "CRLF" after right bracket
"]". With this byte sequence 5B6175746F72756E5D used as magic number it is
easier or faster for above mentioned tools to identify AUTRUN files.

I hope that my recommendation concerning AUTORUN files can be applied for your
used example.

Thanks,
j2j
Last edited by socratis on 6. Aug 2017, 08:49, edited 1 time in total.
Reason: Added ticket related information.
mpack
Site Moderator
Posts: 39156
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: AUTRUN.INF starts with a comment line ";" instead [autorun]

Post by mpack »

Let's get this clear... You want to the devs to modify VirtualBox to accomodate broken third party parsers??
socratis
Site Moderator
Posts: 27330
Joined: 22. Oct 2010, 11:03
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5
Location: Greece

Re: AUTRUN.INF starts with a comment line ";" instead [autorun]

Post by socratis »

It's not that intrusive of a change IMHO. If it helps others work right, I don't see a reason why moving a comment block below the execution block is such a big sacrifice. Here's the file in question (/vbox/src/VBox/Additions/WINNT/Installer/ISO/AUTORUN.INF):

Code: Select all

;
; Copyright (C) 2006-2016 Oracle Corporation
;
; This file is part of VirtualBox Open Source Edition (OSE), as
; available from http://www.virtualbox.org. This file is free software;
; you can redistribute it and/or modify it under the terms of the GNU
; General Public License (GPL) as published by the Free Software
; Foundation, in version 2 as it comes in the "COPYING" file of the
; VirtualBox OSE distribution. VirtualBox OSE is distributed in the
; hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
;

[autorun]
open=VBoxWindowsAdditions.exe
icon=VBoxWindowsAdditions.exe
label=VirtualBox Guest Additions
You move the comments below the actions and everybody lives happily ever after...
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
scottgus1
Site Moderator
Posts: 20965
Joined: 30. Dec 2009, 20:14
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Windows, Linux

Re: AUTRUN.INF starts with a comment line ";" instead [autorun]

Post by scottgus1 »

For what it's worth, this page from Microsoft: Autorun.inf Entries has the autorun tag spelled "[AutoRun]" Camel-Case-Style, not all lowercase. I'd suspect that this spelling would not fit the string suggested by the OP.
mpack
Site Moderator
Posts: 39156
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: AUTRUN.INF starts with a comment line ";" instead [autorun]

Post by mpack »

Precisely. If you're going to make allowances for broken parsers, why stop with this?

And which "other tools" are we talking about anyway? The only tools which need to read autorun.inf are text editors and OS boot code. And the latter shouldn't need any help from the VirtualBox devs to parse a valid file.
socratis
Site Moderator
Posts: 27330
Joined: 22. Oct 2010, 11:03
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5
Location: Greece

Re: AUTRUN.INF starts with a comment line ";" instead [autorun]

Post by socratis »

mpack wrote:And which "other tools" are we talking about anyway?
He gave a really prominent example: "file". That's a standard tool in Unix-like systems (part of the Single Unix Specification actually) which quickly identifies a lot of file types, based on their signature. Example:

Code: Select all

$ file /Users/Shared/VirtualBox/Source/vbox/src/VBox/Additions/WINNT/Installer/ISO/AUTORUN.INF 
AUTORUN.INF: ASCII English text, with CRLF line terminators
After the proposed change however:

Code: Select all

$ file /Users/Shared/VirtualBox/Source/vbox/src/VBox/Additions/WINNT/Installer/ISO/AUTORUN.INF 
AUTORUN.INF: Microsoft Windows Autorun file.
And yes Scott, it covers CamelCase as well... ;)
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
scottgus1
Site Moderator
Posts: 20965
Joined: 30. Dec 2009, 20:14
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Windows, Linux

Re: AUTRUN.INF starts with a comment line ";" instead [autorun]

Post by scottgus1 »

Interesting command! It didn't jump out at me in the OP, I didn't notice it.

Sounds like he's trying to cobble together a ransomware detector or stopper, and attempting to develop signatures for common files.

My thought about the CamelCase was to show that the hex string listed in the first post for an autorun signature matches his lowercase [autorun] but not Microsoft's [AutoRun], so another rule at least would be needed anyway.

FWIW, j2j, how many Guest Additions ISO's would there usually be on a PC? Typically one, unless one keeps older version installers about. Then there'd be maybe three, four, etc. I wouldn't imagine that there'd be that much processing power lost checking one file, even three or four.
socratis
Site Moderator
Posts: 27330
Joined: 22. Oct 2010, 11:03
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5
Location: Greece

Re: AUTRUN.INF starts with a comment line ";" instead [autorun] (#16983)

Post by socratis »

Filed ticket #16983: Autorun.inf not correctly identified from 'file' command.

Patch included.
(yeah right ;) )
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
michaln
Oracle Corporation
Posts: 2973
Joined: 19. Dec 2007, 15:45
Primary OS: MS Windows 7
VBox Version: PUEL
Guest OSses: Any and all
Contact:

Re: AUTRUN.INF starts with a comment line ";" instead [autorun] (#16983)

Post by michaln »

Did you also open a bug for the 'file' command?

Seriously, if you are using a broken tool, that is your problem, not Oracle's.
socratis
Site Moderator
Posts: 27330
Joined: 22. Oct 2010, 11:03
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5
Location: Greece

Re: AUTRUN.INF starts with a comment line ";" instead [autorun] (#16983)

Post by socratis »

I wouldn't go as far as calling 'file' a broken tool. That's a bit.. too much, don't you think, given the fact that it's included with every Unix distribution out there (and not only the traditional ones) and it's part of the Single Unix Specification (IEEE Std 1003.1-2008, 2016 Edition)? A "broken tool" in a standard? I'd say quite the opposite.

And as for the bug report, try to see in as an improvement. I'm definitely against too many bug reports and my typical response is to sway people away from the bug tracker and towards the forums (as you may have noticed in the bug tracker). But 1) I wanted to let the OP know, and 2) I've seen trivial things often discussed and forgotten.

But, as they say in my hometown, "you have the watermelon, but you also have the knife", or in loose translation "it's entirely up to you, I can't do too much about it"... ;)
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
michaln
Oracle Corporation
Posts: 2973
Joined: 19. Dec 2007, 15:45
Primary OS: MS Windows 7
VBox Version: PUEL
Guest OSses: Any and all
Contact:

Re: AUTRUN.INF starts with a comment line ";" instead [autorun] (#16983)

Post by michaln »

The point is that the format of AUTORUN.INF is not defined by the 'file' utility, it is defined by Microsoft. Does Microsoft accept comments? Everything points to the answer being "yes". So why doesn't 'file'?

I didn't mean to say that 'file' as a whole is broken. But it's not perfect. Here's what happened to me today:

Code: Select all

Michals-MacBook-Pro:logs michaln$ file ~/Desktop/Sierra.dmg 
/Users/michaln/Desktop/Sierra.dmg: VAX COFF executable not stripped - version 18354
Should I complain to Apple and ask them to please create their DMG files so that they're not misidentified as VAX COFF executables by 'file'?
socratis
Site Moderator
Posts: 27330
Joined: 22. Oct 2010, 11:03
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5
Location: Greece

Re: AUTRUN.INF starts with a comment line ";" instead [autorun] (#16983)

Post by socratis »

michaln wrote:Should I complain to Apple and ask them to please create their DMG files so that they're not misidentified as VAX COFF executables by 'file'?
Are you sure you don't have a corrupt download? :lol:
No, of course I wasn't trying to say that the 'file' is 100% false-positive free. Nor that comments are not allowed in Autorun.inf, on the contrary. But, if a simple one-line change makes a user happier without breaking at all VirtualBox, why not? That's all...

I should have characterized the ticket as an "Enhancement". ;)
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
mpack
Site Moderator
Posts: 39156
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: AUTRUN.INF starts with a comment line ";" instead [autorun] (#16983)

Post by mpack »

I would be against this change. Moving a comment into an option section of an INF (or INI) implies that the comment only applies in that section. If it applies to the entire file then it should be at the top, exactly where it is now.

And anyway, which other broken parsers should we accomodate with a minor tweak? It's a slippery slope.

I'd say: file a bug report on an appropriate forum for "file".
Post Reply