search

VirusTotal / yara

The pattern matching swiss knife
https://virustotal.github.io/yara/
BSD 3-Clause "New" or "Revised" License
8.08k stars 1.43k forks source link

fix: add base address to elf entrypoint during process scanning #1989

Closed vthib closed 9 months ago

vthib commented 10 months ago

As is done for PE, the entrypoint computed during process memory scanning should be added to the base address of the block, so that the returned value is the process address of the entrypoint.

This bug is only for the deprecated entrypoint keyword, the elf module does not suffer from it