Skip to content

Commit a024154

Browse files
committed
Remove check in dotnet_is_dotnet that doesn't seem necessary.
This function was checking the first two bytes at the entrypoint of .NET files, if the bytes were not `FF 25` the file was not considered a .NET file. This check was overly restrictive, as some files like `8fa7fe73a65296e9ca8301734a0deaa298cda0b7a65f6b7d2ef6d1c8bbb8cd7a` don't have such files at the entrypoint.
1 parent 8242721 commit a024154

File tree

1 file changed

+0
-13
lines changed

1 file changed

+0
-13
lines changed

libyara/modules/dotnet/dotnet.c

-13
Original file line numberDiff line numberDiff line change
@@ -3288,19 +3288,6 @@ static bool dotnet_is_dotnet(PE* pe)
32883288
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR)
32893289
return false;
32903290
}
3291-
else if (!(pe->header->FileHeader.Characteristics & IMAGE_FILE_DLL)) // 32bit
3292-
{
3293-
// Check first 2 bytes of the Entry point are equal to 0xFF 0x25
3294-
int64_t entry_offset = pe_rva_to_offset(
3295-
pe, yr_le32toh(pe->header->OptionalHeader.AddressOfEntryPoint));
3296-
3297-
if (entry_offset < 0 || !fits_in_pe(pe, pe->data + entry_offset, 2))
3298-
return false;
3299-
3300-
const uint8_t* entry_data = pe->data + entry_offset;
3301-
if (!(entry_data[0] == 0xFF && entry_data[1] == 0x25))
3302-
return false;
3303-
}
33043291

33053292
return true;
33063293
}

0 commit comments

Comments
 (0)