Magic-Mirror/retdec
1
0
Fork 0
mirror of https://github.com/avast/retdec.git synced 2024-11-23 13:00:13 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

A more elegant way to tests sections

Browse Source
This commit is contained in:
Ladislav Zezula 2023-03-31 09:11:48 +02:00
parent 5fdd69353c
commit 9f94a0f7d9
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
support/yara_patterns/tools/pe/x86/installers.yara
View File

@ -3424,7 +3424,7 @@ rule wix_toolset_3x
$s03 = "Failed to read section info, data to short: %u"
$h04 = {00 43 F1 00 02 00 00 00} // Wix section header + version
condition:
for any i in (0 .. pe.number_of_sections) : ((pe.sections[i].name == ".wixburn") and ($h04 at pe.sections[i].raw_data_offset)) and
for any section in pe.sections : ((section.name == ".wixburn") and ($h04 at section.raw_data_offset)) and
all of them
}