mirror of
https://github.com/VirusTotal/yara.git
synced 2026-10-12 02:10:00 +00:00
elf.machine can hold any value from the ELF header, but the module only named 14 of them, so a rule targeting anything else had to hardcode the number or drop the module and match the header bytes by hand. Add the architectures from the issue: PARISC, SPARC32PLUS, S390, MCORE, SH, SPARCV9, ARC_COMPACT, BPF and LOONGARCH. 0x27 is exposed under both EM_MCORE and EM_RCE. EM_RCE is the name it was originally registered under and still what some toolchains emit, so a rule written against either name works. Closes #2149