mirror of
https://github.com/VirusTotal/yara.git
synced 2026-10-11 22:49:58 +00:00
A check in `pe_parse_debug_directory` was verifying that the size of the debug directory entry was a multiple of `sizeof(IMAGE_DEBUG_DIRECTORY)`. Although this is true in most cases, is not universally true for all PE files. This check was preventing the extraction of the PDB path from certain EFI boot files, like the ones below. The PDB path in such cases is not a file path but a GUID, though. Some affected files: `6c2abf4b80a87e63eee2996e5cea8f004d49ec0c1806080fa72e960529cba14c` `5487a2ff41e360b1d3b0a58e393b0041c3f269f1053a3e367dfecd48e233457e`
1.9 KiB
1.9 KiB