Fix bug while calculating the imphash in PE files.

When the file imported DLLs that contained a dot (.) in its name, like `glib-2.0.dll`, the file extension was not properly removed, causing the the imphash to be wrong.
This commit is contained in:
Victor M. Alvarez
2023-11-17 11:37:35 +01:00
parent aa0d7a2e6e
commit 01032a6cb2
4 changed files with 11 additions and 1 deletions
+1
View File
@@ -119,6 +119,7 @@ cc_test(
"data/ChipTune.efi",
"data/c6f9709feccf42f2d9e22057182fe185f177fb9daaa2649b4669a24f2ee7e3ba_0h_410h",
"data/ca21e1c32065352d352be6cde97f89c141d7737ea92434831f998080783d5386",
"data/e3d45a2865818756068757d7e319258fef40dad54532ee4355b86bc129f27345",
"data/mtxex.dll",
"data/mtxex_modified_rsrc_rva.dll",
"data/pe_imports",
+9
View File
@@ -276,6 +276,15 @@ int main(int argc, char** argv)
}",
"tests/data/tiny_empty_import_name");
assert_true_rule_file(
"import \"pe\" \
rule test { \
condition: \
pe.imphash() == \"d49b7870cb53f29ec3f42b11cc8bea8b\" \
}",
"tests/data/"
"e3d45a2865818756068757d7e319258fef40dad54532ee4355b86bc129f27345");
#endif
#if defined(HAVE_LIBCRYPTO)