* pe: add signature[i].algorithm_oid
Certificate signature algorithms are encoded using object identifiers
whose text representations depend on the cryptographic library. For
stable YARA rules, it is wiser to rely on the OID, so let's provide
it.
For example, while OpenSSL 1.1.1d resolves 1.2.840.113549.1.1.11 to
"sha256WithRSAEncryption" (or "RSA-SHA256" for the short name), the
only string representation I have gotten out of the Windows CryptoAPI
is "sha256RSA".
* Add documentation for signature[i].algorithm_oid
* Implement pe.entry_point_raw.
Add pe.entry_point_raw which is the raw value of the entry point field from the
optional header. This value is NOT converted to a file offset or a virtual
address, and is just the raw bytes taken straight from the header.
This allows you to use the entry point as it is specified in the file without
having to jump through hoops to parse it by hand in your condition.
* Specify the version in which entry_point_raw was added.
Co-authored-by: Victor M. Alvarez <[email protected]>
instead of a boolean value.
This change affects pe.imports(dll_name) and pe.imports(dll_regex, func_regex).
Like in e68eff98, it remains backward compatible because the count, when
casted to a boolean, will be true if it is larger or equal to 1.
Co-authored-by: mposlusny <[email protected]>
* Add field offsets.
Add field offsets. This is particularly interesting for certain obfuscators
where the fields contain highly interesting values. Knowing their offsets lets
us use these specific values in detections.
* Add docs and pluralize field_offset.
* rich_internal function now returns the sum of counts
of the matching rich entries instead of a boolean
It remains backwards compatible thanks to non-null values being
considered as true and when not found it returns 0 (false).
* Update documentation of the `toolid` and `version` in PE module
to reflect changes of behavior: it now returns the sum of counts matching
to given `toolid` and `version`.
* Added test for the updated rich_signature function
Add crc32 functions to the hash module. They work in the normal "offset and
size" way and on arbitrary strings.
While here, add tests for it and also documentation.
* Added more fields from IMAGE_FILE_HEADER, IMAGE_OPTIONAL_HEADER(64) and IMAGE_SECTION_HEADER
* Added constants for data directory indices
* Fixed whitespaces
* Documented changes in "bug_868_add_more_pe_fields"
* Added IMAGE_FILE_HEADER::SizeOfOptionalHeader
Fixed typos in the RST documentation file
* Fixed whitespaces
* Fixed example
* Added missing declaration of "size_of_optional_header"
Wesley Shields