VirusTotal/yara
1
0
Fork 0
mirror of https://github.com/VirusTotal/yara.git synced 2026-10-12 02:10:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Set pe.overlay.offset to 0 for PE files that don't have an overlaid.

Browse Source 
Until now pe.overlay.offset was undefined in such cases. For non-PE files this fields keep being undefined.
This commit is contained in:
Victor M. Alvarez
2021-01-07 10:17:37 +01:00
parent 4782d10257
commit 0ffcba00a6
3 changed files with 19 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/modules/pe.rst
+4 -2
View File
@@ -579,11 +579,13 @@ Reference
.. c:member:: offset
Overlay section offset.
Overlay section offset. This is 0 for PE files that don't have overlaid
data and undefined for non-PE files.
.. c:member:: size
Overlay section size.
Overlay section size. This is 0 for PE files that don't have overlaid
data and undefined for non-PE files.
*Example: uint8(0x0d) at pe.overlay.offset and pe.overlay.size > 1024*
libyara/modules/pe/pe.c
+14 -9
View File
@@ -1537,7 +1537,7 @@ static void pe_parse_header(PE* pe, uint64_t base_address, int flags)
PIMAGE_DATA_DIRECTORY data_dir;
char section_name[IMAGE_SIZEOF_SHORT_NAME + 1];
int i, scount, ddcount;
int scount, ddcount;
uint64_t highest_sec_siz = 0;
uint64_t highest_sec_ofs = 0;
@@ -1736,7 +1736,7 @@ static void pe_parse_header(PE* pe, uint64_t base_address, int flags)
ddcount = yr_le16toh(OptionalHeader(pe, NumberOfRvaAndSizes));
ddcount = yr_min(ddcount, IMAGE_NUMBEROF_DIRECTORY_ENTRIES);
for (i = 0; i < ddcount; i++)
for (int i = 0; i < ddcount; i++)
{
if (!struct_fits_in_pe(pe, data_dir, IMAGE_DATA_DIRECTORY))
break;
@@ -1763,7 +1763,7 @@ static void pe_parse_header(PE* pe, uint64_t base_address, int flags)
scount = yr_min(
yr_le16toh(pe->header->FileHeader.NumberOfSections), MAX_PE_SECTIONS);
for (i = 0; i < scount; i++)
for (int i = 0; i < scount; i++)
{
if (!struct_fits_in_pe(pe, section, IMAGE_SECTION_HEADER))
break;
@@ -1848,15 +1848,20 @@ static void pe_parse_header(PE* pe, uint64_t base_address, int flags)
// RawData + RawOffset of the last section on the physical file
last_section_end = highest_sec_siz + highest_sec_ofs;
// "overlay.offset" is set to YR_UNDEFINED for files that do not have an
// overlay
// For PE files that have overlaid data overlay.offset contains the offset
// within the file where the overlay starts and overlay.size contains the
// size. If the PE file doesn't have an overlay both fields are 0, if the
// file is not a PE file (or is a malformed PE) both fields are YR_UNDEFINED.
if (last_section_end && (pe->data_size > last_section_end))
{
set_integer(last_section_end, pe->object, "overlay.offset");
// "overlay.size" is zero for well formed PE files that do not have an
// overlay and YR_UNDEFINED for malformed PE files or non-PE files.
if (last_section_end && (pe->data_size >= last_section_end))
set_integer(pe->data_size - last_section_end, pe->object, "overlay.size");
}
else
{
set_integer(0, pe->object, "overlay.offset");
set_integer(0, pe->object, "overlay.size");
}
}
//
tests/test-pe.c
+1 -1
View File
@@ -208,7 +208,7 @@ int main(int argc, char** argv)
"import \"pe\" \
rule test { \
condition: \
pe.overlay.size == 0 \
pe.overlay.offset == 0 and pe.overlay.size == 0 \
}",
"tests/data/tiny");