Skip to content

Commit

Permalink
Remove check in dotnet_is_dotnet that doesn't seem necessary.
Browse files Browse the repository at this point in the history
This function was checking the first two bytes at the entrypoint of .NET files, if the bytes were not `FF 25` the file was not considered a .NET file. This check was overly restrictive, as some files like `8fa7fe73a65296e9ca8301734a0deaa298cda0b7a65f6b7d2ef6d1c8bbb8cd7a` don't have such files at the entrypoint.
  • Loading branch information
plusvic committed Mar 7, 2024
1 parent 8242721 commit a024154
Showing 1 changed file with 0 additions and 13 deletions.
13 changes: 0 additions & 13 deletions libyara/modules/dotnet/dotnet.c
Original file line number Diff line number Diff line change
Expand Up @@ -3288,19 +3288,6 @@ static bool dotnet_is_dotnet(PE* pe)
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR)
return false;
}
else if (!(pe->header->FileHeader.Characteristics & IMAGE_FILE_DLL)) // 32bit
{
// Check first 2 bytes of the Entry point are equal to 0xFF 0x25
int64_t entry_offset = pe_rva_to_offset(
pe, yr_le32toh(pe->header->OptionalHeader.AddressOfEntryPoint));

if (entry_offset < 0 || !fits_in_pe(pe, pe->data + entry_offset, 2))
return false;

const uint8_t* entry_data = pe->data + entry_offset;
if (!(entry_data[0] == 0xFF && entry_data[1] == 0x25))
return false;
}

return true;
}
Expand Down

0 comments on commit a024154

Please sign in to comment.