VirusTotal/yara
1
0
Fork 0
mirror of https://github.com/VirusTotal/yara.git synced 2026-10-11 22:49:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

Populate dotnet.resources[x].offset and dotnet.resources[x].length even if falling outside of the file

Browse Source 
Until now, these two fields were populated only when the offset and offset + length were within the file boundaries. This meant that the fields were undefined for some files that were truncated. For instance, 3323480fc4e35f73a8e93c4a0658c818d7e517df7ba15ba4cbb5cd2b6058cb0f.
This commit is contained in:
Victor M. Alvarez
2024-04-08 12:04:17 +02:00
parent 9c26038171
commit 80972f0b4c
1 changed files with 0 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libyara/modules/dotnet/dotnet.c
-4
View File
@@ -2974,10 +2974,6 @@ void dotnet_parse_tilde_2(
resource_size = yr_le32toh(
*(DWORD*) (pe->data + resource_base + resource_offset));
if (!fits_in_pe(
pe, pe->data + resource_base + resource_offset, resource_size))
continue;
// Add 4 to skip the size.
yr_set_integer(
resource_base + resource_offset + 4,