From b7aa190381064e018ced916f6229ef080f57539e Mon Sep 17 00:00:00 2001 From: Ana Maria Martinez Gomez Date: Wed, 24 Mar 2021 11:53:58 +0100 Subject: [PATCH] add load-code/pe/parse-pe-exports.yml Identify parsing PE export data, used when writing your own `GetProcAddress()` implementation. reference: Practical Malware Analysis, Chapter 19 f --- load-code/pe/parse-pe-exports.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 load-code/pe/parse-pe-exports.yml diff --git a/load-code/pe/parse-pe-exports.yml b/load-code/pe/parse-pe-exports.yml new file mode 100644 index 00000000..43560fbc --- /dev/null +++ b/load-code/pe/parse-pe-exports.yml @@ -0,0 +1,20 @@ +rule: + meta: + name: parse PE exports + namespace: load-code/pe + author: "@Ana06" + scope: function + references: + - Practical Malware Analysis, Chapter 19 + examples: + - E4C33AC3638EEF68311F8AC0D72483C7:0x401390 + features: + - and: + - offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew + - or: + - offset/x32: 0x78 = IMAGE_NT_HEADERS32.OptionalHeader.DataDirectory.VirtualAddress + - offset/x64: 0x88 = IMAGE_NT_HEADERS64.OptionalHeader.DataDirectory.VirtualAddress + - offset: 0x18 = IMAGE_EXPORT_DIRECTORY.NumberOfNames + - offset: 0x20 = IMAGE_EXPORT_DIRECTORY.AddressOfNames + - offset: 0x24 = IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals + - offset: 0x1C = IMAGE_EXPORT_DIRECTORY.AddressOfFunctions