Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add debug_details and load_config_timestamp to PE module. #1976

Open
wants to merge 4 commits into
base: master
Choose a base branch
from

Commits on Sep 28, 2023

  1. Add debug_infos array to pe module.

    Fun fact: debug information is actually an array of structures. Historically,
    YARA has stopped parsing after finding the first entry with a PDB path (with
    some other restrictions around the type of debug entry this is). However, each
    entry can have different information (including pdb paths), so let's add an
    array of debug_infos structures which contain timestamp, type and pdb path.
    
    Just in testing I discovered legit binaries that have different PDB paths in
    them, which is actually kind of interesting.
    wxsBSD committed Sep 28, 2023
    Configuration menu
    Copy the full SHA
    c1afe65 View commit details
    Browse the repository at this point in the history

Commits on Sep 29, 2023

  1. Implement load config parsing.

    Specifically, I'm only parsing out the timestamp field of the structure.
    
    While here, rename the newly created "debug_infos" array to "debug_details".
    wxsBSD committed Sep 29, 2023
    Configuration menu
    Copy the full SHA
    ee67507 View commit details
    Browse the repository at this point in the history
  2. Fix tests after rename.

    wxsBSD committed Sep 29, 2023
    Configuration menu
    Copy the full SHA
    2884079 View commit details
    Browse the repository at this point in the history
  3. Configuration menu
    Copy the full SHA
    645fc36 View commit details
    Browse the repository at this point in the history