VirusTotal/yara
1
0
Fork 0
mirror of https://github.com/VirusTotal/yara.git synced 2026-10-12 02:10:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: add base address to elf entrypoint during process scanning (#1989)

Browse Source 
As is done for PE, the entrypoint computed during process memory
scanning should be added to the base address of the block, so that the
returned value is the process address of the entrypoint.
This commit is contained in:
Vincent Thiberville
2023-11-16 09:38:40 +01:00
committed by GitHub
parent 12566310ea
commit 587c10ada7
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libyara/exefiles.c
+2 -2
View File
@@ -405,7 +405,7 @@ uint64_t yr_get_entry_point_address(
elf_header32 = (elf32_header_t*) buffer;
if (elf_header32->type == ELF_ET_EXEC)
return elf_header32->entry;
return base_address + elf_header32->entry;
break;
@@ -413,7 +413,7 @@ uint64_t yr_get_entry_point_address(
elf_header64 = (elf64_header_t*) buffer;
if (elf_header64->type == ELF_ET_EXEC)
return elf_header64->entry;
return base_address + elf_header64->entry;
break;
}