Closed PanosKwork closed 1 year ago
import "elf"
import "console"
rule test
{
condition:
(
for any i in (0..elf.number_of_sections):
(
console.log(elf.sections[i].name) and false
)
)
}
output
.interp
.note.ABI-tag
.note.gnu.build-id
.gnu.hash
.dynsym
.dynstr
.gnu.version
.gnu.version_r
.rela.dyn
.rela.plt
.init
.plt
.text
.fini
.rodata
.app.version
.cfgETD
.eh_frame_hdr
.eh_frame
.gcc_except_table
.tbss
.init_array
.fini_array
.jcr
.data.rel.ro
.dynamic
.got
.data
nocommon
.bss
.comment
.shstrtab
os:linux
yara:4.2.3,4.4.0
sample:d4645d2c29505cf10d1b201826c777b62cbf9d752cb1008bef1192e0dd545a82