VirusTotal / yara

The pattern matching swiss knife
https://virustotal.github.io/yara/
BSD 3-Clause "New" or "Revised" License
8.08k stars 1.43k forks source link

the computation of imphash in pe module #1965

Closed syyoo84 closed 9 months ago

syyoo84 commented 11 months ago

Describe the bug ".drv" in module names is ignored when calculating imphash (".drv" extension was not removed) Please also add the “.drv” extension.

To Reproduce Steps to reproduce the behavior:

Expected behavior A clear and concise description of what you expected to happen.

Screenshots If applicable, add screenshots to help explain your problem.

Please complete the following information:

Additional context Add any other context about the problem here.

plusvic commented 11 months ago

We are using the pefile implementation as the reference for our implementation. If the proposed change is applied to pefile, we'll do the same here. It's important to have a reference implementation that sets the standard.

syyoo84 commented 9 months ago

thank you for your support