vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

add load-code/pe/parse-pe-exports.yml

Browse source 
Identify parsing PE export data, used when writing your own
`GetProcAddress()` implementation.

reference: Practical Malware Analysis, Chapter 19

f
This commit is contained in:
Ana Maria Martinez Gomez 2021-03-24 11:53:58 +01:00
parent 684f817111
commit b7aa190381
No known key found for this signature in database
GPG key ID: 708FEFF2737E9788
1 changed files with 20 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

20
load-code/pe/parse-pe-exports.yml Normal file
View file

@ -0,0 +1,20 @@
rule:
meta:
name: parse PE exports
namespace: load-code/pe
author: "@Ana06"
scope: function
references:
- Practical Malware Analysis, Chapter 19
examples:
- E4C33AC3638EEF68311F8AC0D72483C7:0x401390
features:
- and:
- offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew
- or:
- offset/x32: 0x78 = IMAGE_NT_HEADERS32.OptionalHeader.DataDirectory.VirtualAddress
- offset/x64: 0x88 = IMAGE_NT_HEADERS64.OptionalHeader.DataDirectory.VirtualAddress
- offset: 0x18 = IMAGE_EXPORT_DIRECTORY.NumberOfNames
- offset: 0x20 = IMAGE_EXPORT_DIRECTORY.AddressOfNames
- offset: 0x24 = IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals
- offset: 0x1C = IMAGE_EXPORT_DIRECTORY.AddressOfFunctions