VirusTotal / yara

The pattern matching swiss knife
https://virustotal.github.io/yara/
BSD 3-Clause "New" or "Revised" License
7.93k stars 1.42k forks source link

fix several bugs in array type handling in dotnet module #2064

Closed vthib closed 2 months ago

vthib commented 3 months ago

Several bugs were present in the parsing and generation of a string to represent an array type, notably when the "lo_bound" value is set.

plusvic commented 3 months ago

@vthib do you have some .NET files that trigger these issues. I want to have some reference files and check that this is correctly done on YARA-X as well.

vthib commented 3 months ago

Yes, I crafted some files for testing in boreal, one of which test array sizes: types2.dll

lo bound values on arrays cannot be used in C# files afaik, but they can easily be tested with MSIL files. The aforementioned file was generated from this source code: types2.cil

This makes it easy to compare the syntax used in the MSIL file with the type strings generated in the yara module.

vthib commented 2 months ago

I fixed an unnecessary change, should be ok now