Implement pe.entry_point_raw. (VirusTotal#1410)

* Implement pe.entry_point_raw. Add pe.entry_point_raw which is the raw value of the entry point field from the optional header. This value is NOT converted to a file offset or a virtual address, and is just the raw bytes taken straight from the header. This allows you to use the entry point as it is specified in the file without having to jump through hoops to parse it by hand in your condition. * Specify the version in which entry_point_raw was added. Co-authored-by: Victor M. Alvarez <[email protected]>
EmbarkStudios · Dec 2, 2020 · 7732801 · 7732801
1 parent 9577ffc
commit 7732801
Show file tree

Hide file tree

Showing 3 changed files with 22 additions and 1 deletion.
diff --git a/docs/modules/pe.rst b/docs/modules/pe.rst
@@ -157,10 +157,17 @@ Reference
 
 .. c:type:: entry_point
 
-    Entry point raw offset or virtual address depending on whether YARA is
+    Entry point file offset or virtual address depending on whether YARA is
     scanning a file or process memory respectively. This is equivalent to the
     deprecated ``entrypoint`` keyword.
 
+.. c:type:: entry_point_raw
+
+    Entry point raw value from the optional header of the PE. This value is not
+    converted to a file offset or an RVA.
+
+    .. versionadded:: 4.1.0
+
 .. c:type:: base_of_code
 
     .. versionadded:: 3.8.0

diff --git a/libyara/modules/pe/pe.c b/libyara/modules/pe/pe.c
@@ -1582,6 +1582,11 @@ static void pe_parse_header(PE* pe, uint64_t base_address, int flags)
       pe->object,
       "entry_point");
 
+  set_integer(
+      yr_le32toh(OptionalHeader(pe, AddressOfEntryPoint)),
+      pe->object,
+      "entry_point_raw");
+
   set_integer(
       IS_64BITS_PE(pe) ? yr_le64toh(OptionalHeader(pe, ImageBase))
                        : yr_le32toh(OptionalHeader(pe, ImageBase)),
@@ -2765,6 +2770,7 @@ begin_declarations
   declare_integer("characteristics");
 
   declare_integer("entry_point");
+  declare_integer("entry_point_raw");
   declare_integer("image_base");
   declare_integer("number_of_rva_and_sizes");
 

diff --git a/tests/test-pe.c b/tests/test-pe.c
@@ -92,6 +92,14 @@ int main(int argc, char** argv)
       }",
       "tests/data/tiny");
 
+  assert_true_rule_file(
+      "import \"pe\" \
+      rule test { \
+        condition: \
+          pe.entry_point_raw == 0x1380 \
+      }",
+      "tests/data/mtxex.dll");
+
   assert_true_rule_file(
       "import \"pe\" \
       rule test { \