elf.machine can hold any value from the ELF header, but the module only
named 14 of them, so a rule targeting anything else had to hardcode the
number or drop the module and match the header bytes by hand.
Add the architectures from the issue: PARISC, SPARC32PLUS, S390, MCORE,
SH, SPARCV9, ARC_COMPACT, BPF and LOONGARCH.
0x27 is exposed under both EM_MCORE and EM_RCE. EM_RCE is the name it was
originally registered under and still what some toolchains emit, so a rule
written against either name works.
Closes#2149
Missing byte swap in the ELF symtab/dynsym link check
The SHT_SYMTAB and SHT_DYNSYM string table check compares sh_link against the raw e_shnum (sh_entry_count) while every other use in the macro byte-swaps it, so on a little-endian host reading a big-endian ELF the check accepts a link past the real section count and parses the symbol string table from an out-of-range section header. Swapped it to match the sibling reads, and added a regression test scanning a crafted big-endian ELF whose only symtab carries an out-of-range sh_link.
The telfhash algorithm excludes x64 functions, see here:
https://github.com/trendmicro/telfhash/blob/d2a82f85a5b/telfhash/telfhash.py#L59
Looks like there was a copy paste error when porting this algorithm in
YARA, as the test for "is_bad_prefix" is copied, but this is not the
right test of "is_x86_64".
This PR properly fixes it.
With this change the yr_scanner_scan_mem_blocks function can return ERROR_BLOCK_NOT_READY when the YR_MEMORY_BLOCK_ITERATOR that provides memory blocks to the function is not ready to return the next block. After this error the caller can retry the call to yr_scanner_scan_mem_blocks multiple times until the function succeeds or fails with some other error code.
Co-authored-by: Simon Hardy-Francis <[email protected]>
* Fix pe module for big-endian architectures
* No longer skip pe test on big-endian architectures
(The ifdef was wrong anyhow.)
* Add tests for elf module
* Fix elf module for big-endian architectures
Mr.X