VirusTotal / yara

The pattern matching swiss knife
https://virustotal.github.io/yara/
BSD 3-Clause "New" or "Revised" License
7.95k stars 1.42k forks source link

Fix endianness issues in macho module #2041

Closed plusvic closed 5 months ago

plusvic commented 5 months ago

This is a backward incompatible change that affects the macho.magic field. After this change the value in the magic field looks exactly as it looks in the file regardless of the endianness of the current platform, if the file starts with CA FE BA BE the value in magic is 0xCAFEBABE, not 0xBEBAFECA as it used to be in little-endian architectures.

Before this change, the magic value inconsistent between platforms with different endianness.