search

VirusTotal / yara

The pattern matching swiss knife
https://virustotal.github.io/yara/
BSD 3-Clause "New" or "Revised" License
8.34k stars 1.45k forks source link

fix: add base address to elf entrypoint during process scanning #1989

Closed vthib closed 1 year ago

vthib commented 1 year ago

As is done for PE, the entrypoint computed during process memory scanning should be added to the base address of the block, so that the returned value is the process address of the entrypoint.

This bug is only for the deprecated entrypoint keyword, the elf module does not suffer from it