search

VirusTotal / yara

The pattern matching swiss knife
https://virustotal.github.io/yara/
BSD 3-Clause "New" or "Revised" License
8.32k stars 1.45k forks source link

pe.signatures[n].issuer not working at the lasts version #2094

Closed Vendettail closed 4 months ago

Vendettail commented 4 months ago

for version 4.0.2 the following code working well: for all n in (0..pe.number_of_signatures): ( not pe.signatures[n].issuer contains "Microsoft" ) but for version 4.5.1 it's not. some for the 'subject' field, I do not know when it starts to fail.

wxsBSD commented 4 months ago

Do you have a hash that triggers this?

Vendettail commented 4 months ago

Do you have a hash that triggers this?

e81f3632a177cc70e45b405c4383e4f11e4e1661158127dfb29615db769b68dd

wxsBSD commented 4 months ago

Ah, I see what is going on here: pe.signatures array indexing starts at zero. In your example, the first time through the loop it will evaluate to true (it does not contain "Microsoft") but the second time through (when n is 1) not pe.signatures[n].issuer contains "Microsoft" is undefined.

What you want to do is for all n in (0..pe.number_of_signatures - 1): (not pe.signatures[n].issuer contains "Microsoft")

I'm guessing b7da5d2835cc4cf8a15027da30265addab1a4be5 has something to do with this change?

Vendettail commented 4 months ago

ha, so the "bug" belongs to the oldest versions, not the new ones, at the older version the contains operation returns true (?) for undefine so it "works", do I get it right?

wxsBSD commented 4 months ago

I think so. Not entirely sure to be honest.

Vendettail commented 4 months ago

@wxsBSD tnx!