Implement pe.entry_point_raw. (#1410)

* Implement pe.entry_point_raw.

Add pe.entry_point_raw which is the raw value of the entry point field from the
optional header. This value is NOT converted to a file offset or a virtual
address, and is just the raw bytes taken straight from the header.

This allows you to use the entry point as it is specified in the file without
having to jump through hoops to parse it by hand in your condition.

* Specify the version in which entry_point_raw was added.

Co-authored-by: Victor M. Alvarez <[email protected]>

docs/modules/pe.rst

@@ -157,10 +157,17 @@ Reference
 
 .. c:type:: entry_point
 
-    Entry point raw offset or virtual address depending on whether YARA is
+    Entry point file offset or virtual address depending on whether YARA is
     scanning a file or process memory respectively. This is equivalent to the
     deprecated ``entrypoint`` keyword.
 
+.. c:type:: entry_point_raw
+
+    Entry point raw value from the optional header of the PE. This value is not
+    converted to a file offset or an RVA.
+    
+    .. versionadded:: 4.1.0
+
 .. c:type:: base_of_code
 
     .. versionadded:: 3.8.0

libyara/modules/pe/pe.c

@@ -1582,6 +1582,11 @@ static void pe_parse_header(PE* pe, uint64_t base_address, int flags)
       pe->object,
       "entry_point");
 
+  set_integer(
+      yr_le32toh(OptionalHeader(pe, AddressOfEntryPoint)),
+      pe->object,
+      "entry_point_raw");
+
   set_integer(
       IS_64BITS_PE(pe) ? yr_le64toh(OptionalHeader(pe, ImageBase))
                        : yr_le32toh(OptionalHeader(pe, ImageBase)),
@@ -2765,6 +2770,7 @@ begin_declarations
   declare_integer("characteristics");
 
   declare_integer("entry_point");
+  declare_integer("entry_point_raw");
   declare_integer("image_base");
   declare_integer("number_of_rva_and_sizes");
 

tests/test-pe.c

@@ -92,6 +92,14 @@ int main(int argc, char** argv)
       }",
       "tests/data/tiny");
 
+  assert_true_rule_file(
+      "import \"pe\" \
+      rule test { \
+        condition: \
+          pe.entry_point_raw == 0x1380 \
+      }",
+      "tests/data/mtxex.dll");
+
   assert_true_rule_file(
       "import \"pe\" \
       rule test { \