-
Notifications
You must be signed in to change notification settings - Fork 1.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Wrong offset used when checking Version string of .net metadata #1708
Comments
yara/libyara/modules/dotnet/dotnet.c Lines 1658 to 1676 in ee78353
And in line 1670, shouldn't it be |
dangodangodango
added a commit
to dangodangodango/yara
that referenced
this issue
May 14, 2022
I think you're right. Any chance you plan to submit dangodangodango@ac71504 as a PR? I think it is the correct fix (but I haven't tested it to be honest). |
dangodangodango
added a commit
to dangodangodango/yara
that referenced
this issue
May 20, 2022
Build a dotnet pe that triggers this issue: https://github.com/dangodangodango/BadDotnetPe
BitsOfBinary
pushed a commit
to BitsOfBinary/yara
that referenced
this issue
May 29, 2022
* Fix issue VirusTotal#1708 * Add test case for VirusTotal#1708 Build a dotnet pe that triggers this issue: https://github.com/dangodangodango/BadDotnetPe
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
yara/libyara/modules/dotnet/dotnet.c
Lines 1710 to 1728 in ee78353
yara/libyara/modules/dotnet/dotnet.c
Lines 1637 to 1657 in ee78353
The above two places (line 1653 and line 1724) are checking whether metadata version string is fits in pe, Version string offset is
pe->data + offset + sizeof(NET_METADATA)
, and size ismd_len
. But the above code checks the md_len bytes starting fromoffset
(which ismetadata_root
)The correct code should be as follows:
And in the function
dotnet_is_dotnet
, the variableoffset
is not updated to metadata_root, so in line 1653,offset
is still the offset ofCLI_HEADER
, this is also a problem.The text was updated successfully, but these errors were encountered: