VirusTotal/yara
1
0
Fork 0
mirror of https://github.com/VirusTotal/yara.git synced 2026-10-12 02:10:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Expose function RVA in pe.export_details[] (#1882)

Browse Source
This commit is contained in:
Tomáš Ďuriš
2023-08-23 15:28:04 +02:00
committed by GitHub
parent d7e67ff54b
commit 0023a11818
2 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libyara/modules/pe/pe.c
+4
View File
@@ -1655,6 +1655,9 @@ static void pe_parse_exports(PE* pe)
yr_set_integer(
ordinal_base + i, pe->object, "export_details[%i].ordinal", exp_sz);
yr_set_integer(
yr_le32toh(function_addrs[i]), pe->object, "export_details[%i].rva", exp_sz);
// Don't check for a failure here since some packers make this an invalid
// value.
offset = pe_rva_to_offset(pe, yr_le32toh(function_addrs[i]));
@@ -3805,6 +3808,7 @@ begin_declarations
declare_string("name");
declare_string("forward_name");
declare_integer("ordinal");
declare_integer("rva");
end_struct_array("export_details")
begin_struct_array("import_details")
tests/test-pe.c
+6 -1
View File
@@ -508,6 +508,10 @@ int main(int argc, char** argv)
pe.export_details[0].offset == 1072 and \
pe.export_details[0].name == \"DllGetClassObject\" and \
pe.export_details[0].ordinal == 1 and \
pe.export_details[0].rva == 0x1030 and \
pe.export_details[1].rva == 0x267d and \
pe.export_details[2].rva == 0x26a8 and \
pe.export_details[3].rva == 0x26ca and \
pe.export_details[1].forward_name == \"COMSVCS.GetObjectContext\" \
}",
"tests/data/mtxex.dll");
@@ -554,7 +558,8 @@ int main(int argc, char** argv)
"import \"pe\" \
rule test { \
condition: \
pe.export_details[0].name == \"CP_PutItem\" \
pe.export_details[0].name == \"CP_PutItem\" and \
pe.export_details[0].rva == 0x106c \
}",
"tests/data/"
"079a472d22290a94ebb212aa8015cdc8dd28a968c6b4d3b88acdd58ce2d3b885.upx");