From 587c10ada7c554cc5b9dd84cea193b35f6fcbca3 Mon Sep 17 00:00:00 2001 From: Vincent Thiberville Date: Thu, 16 Nov 2023 09:38:40 +0100 Subject: [PATCH] fix: add base address to elf entrypoint during process scanning (#1989) As is done for PE, the entrypoint computed during process memory scanning should be added to the base address of the block, so that the returned value is the process address of the entrypoint. --- libyara/exefiles.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libyara/exefiles.c b/libyara/exefiles.c index 89dcf9b4..2ab06312 100644 --- a/libyara/exefiles.c +++ b/libyara/exefiles.c @@ -405,7 +405,7 @@ uint64_t yr_get_entry_point_address( elf_header32 = (elf32_header_t*) buffer; if (elf_header32->type == ELF_ET_EXEC) - return elf_header32->entry; + return base_address + elf_header32->entry; break; @@ -413,7 +413,7 @@ uint64_t yr_get_entry_point_address( elf_header64 = (elf64_header_t*) buffer; if (elf_header64->type == ELF_ET_EXEC) - return elf_header64->entry; + return base_address + elf_header64->entry; break; }