Skip to content

Commit 90c43e2

Browse files
plusvicplusvic
committed
Try fixing issue #1855.
PR #1768 added RVA field to function details in PE module. The new code had the following line: ``` rva_address = yr_le64toh(import_descriptor->FirstThunk + (sizeof(uint64_t) * func_idx)); ``` The `yr_le64toh` should be used for converting the value of `import_descriptor->FirstThunk` from little-endian to the host's endianness *before* performing the add operation. However, the addition was performed before the conversion. This may be the cause of some test cases failing in big endian platforms.
1 parent 4fe9793 commit 90c43e2

File tree

1 file changed

+89
-48
lines changed
  • libyara/modules/pe

1 file changed

+89
-48
lines changed

‎libyara/modules/pe/pe.c

Lines changed: 89 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -837,7 +837,8 @@ static IMPORT_FUNCTION* pe_parse_import_descriptor(
837837
has_ordinal = 1;
838838
}
839839

840-
rva_address = yr_le64toh(import_descriptor->FirstThunk + (sizeof(uint64_t) * func_idx));
840+
rva_address = yr_le64toh(import_descriptor->FirstThunk) +
841+
(sizeof(uint64_t) * func_idx);
841842

842843
if (name != NULL || has_ordinal == 1)
843844
{
@@ -911,7 +912,8 @@ static IMPORT_FUNCTION* pe_parse_import_descriptor(
911912
has_ordinal = 1;
912913
}
913914

914-
rva_address = yr_le32toh(import_descriptor->FirstThunk + (sizeof(uint32_t) * func_idx));
915+
rva_address = yr_le32toh(
916+
import_descriptor->FirstThunk + (sizeof(uint32_t) * func_idx));
915917

916918
if (name != NULL || has_ordinal == 1)
917919
{
@@ -1013,7 +1015,8 @@ void pe_set_imports(
10131015
{
10141016
yr_set_string(func->name, pe->object, fun_name, dll_cnt, fun_cnt);
10151017
if (func->has_ordinal)
1016-
yr_set_integer(func->ordinal, pe->object, fun_ordinal, dll_cnt, fun_cnt);
1018+
yr_set_integer(
1019+
func->ordinal, pe->object, fun_ordinal, dll_cnt, fun_cnt);
10171020
else
10181021
yr_set_integer(YR_UNDEFINED, pe->object, fun_ordinal, dll_cnt, fun_cnt);
10191022
if (func->rva)
@@ -1114,7 +1117,8 @@ static IMPORTED_DLL* pe_parse_imports(PE* pe)
11141117
}
11151118

11161119
yr_set_integer(num_imports, pe->object, "number_of_imports");
1117-
yr_set_integer(num_function_imports, pe->object, "number_of_imported_functions");
1120+
yr_set_integer(
1121+
num_function_imports, pe->object, "number_of_imported_functions");
11181122
pe_set_imports(
11191123
pe,
11201124
head,
@@ -1369,7 +1373,7 @@ static void* pe_parse_delayed_imports(PE* pe)
13691373
imported_func->has_ordinal = 1;
13701374
}
13711375

1372-
imported_func->rva = yr_le64toh(func_rva);
1376+
imported_func->rva = yr_le64toh(func_rva);
13731377

13741378
num_function_imports++;
13751379
name_rva += pointer_size;
@@ -1628,19 +1632,22 @@ static void pe_parse_exports(PE* pe)
16281632
for (int j = 0; j < cert->sha1.len; ++j) \
16291633
sprintf(thumbprint_ascii + (j * 2), "%02x", cert->sha1.data[j]); \
16301634
\
1631-
yr_set_string( \
1635+
yr_set_string( \
16321636
(char*) thumbprint_ascii, pe->object, fmt ".thumbprint", __VA_ARGS__); \
16331637
\
1634-
yr_set_string(cert->issuer, pe->object, fmt ".issuer", __VA_ARGS__); \
1635-
yr_set_string(cert->subject, pe->object, fmt ".subject", __VA_ARGS__); \
1638+
yr_set_string(cert->issuer, pe->object, fmt ".issuer", __VA_ARGS__); \
1639+
yr_set_string(cert->subject, pe->object, fmt ".subject", __VA_ARGS__); \
16361640
/* Versions are zero based, so add one. */ \
1637-
yr_set_integer(cert->version + 1, pe->object, fmt ".version", __VA_ARGS__); \
1638-
yr_set_string(cert->sig_alg, pe->object, fmt ".algorithm", __VA_ARGS__); \
1639-
yr_set_string( \
1641+
yr_set_integer( \
1642+
cert->version + 1, pe->object, fmt ".version", __VA_ARGS__); \
1643+
yr_set_string(cert->sig_alg, pe->object, fmt ".algorithm", __VA_ARGS__); \
1644+
yr_set_string( \
16401645
cert->sig_alg_oid, pe->object, fmt ".algorithm_oid", __VA_ARGS__); \
1641-
yr_set_string(cert->serial, pe->object, fmt ".serial", __VA_ARGS__); \
1642-
yr_set_integer(cert->not_before, pe->object, fmt ".not_before", __VA_ARGS__); \
1643-
yr_set_integer(cert->not_after, pe->object, fmt ".not_after", __VA_ARGS__); \
1646+
yr_set_string(cert->serial, pe->object, fmt ".serial", __VA_ARGS__); \
1647+
yr_set_integer( \
1648+
cert->not_before, pe->object, fmt ".not_before", __VA_ARGS__); \
1649+
yr_set_integer( \
1650+
cert->not_after, pe->object, fmt ".not_after", __VA_ARGS__); \
16441651
} while (0)
16451652

16461653
void _process_authenticode(
@@ -1677,7 +1684,8 @@ void _process_authenticode(
16771684
for (int j = 0; j < authenticode->digest.len; ++j)
16781685
sprintf(digest_ascii + (j * 2), "%02x", authenticode->digest.data[j]);
16791686

1680-
yr_set_string(digest_ascii, pe->object, "signatures[%i].digest", *sig_count);
1687+
yr_set_string(
1688+
digest_ascii, pe->object, "signatures[%i].digest", *sig_count);
16811689
yr_free(digest_ascii);
16821690
}
16831691

@@ -2101,7 +2109,8 @@ static void pe_parse_header(PE* pe, uint64_t base_address, int flags)
21012109
pe->object,
21022110
"size_of_headers");
21032111

2104-
yr_set_integer(yr_le32toh(OptionalHeader(pe, CheckSum)), pe->object, "checksum");
2112+
yr_set_integer(
2113+
yr_le32toh(OptionalHeader(pe, CheckSum)), pe->object, "checksum");
21052114

21062115
yr_set_integer(
21072116
yr_le16toh(OptionalHeader(pe, Subsystem)), pe->object, "subsystem");
@@ -2291,7 +2300,8 @@ static void pe_parse_header(PE* pe, uint64_t base_address, int flags)
22912300
if (last_section_end && (pe->data_size > last_section_end))
22922301
{
22932302
yr_set_integer(last_section_end, pe->object, "overlay.offset");
2294-
yr_set_integer(pe->data_size - last_section_end, pe->object, "overlay.size");
2303+
yr_set_integer(
2304+
pe->data_size - last_section_end, pe->object, "overlay.size");
22952305
}
22962306
else
22972307
{
@@ -3058,7 +3068,8 @@ define_function(delayed_import_rva)
30583068

30593069
for (int i = 0; i < num_imports; i++)
30603070
{
3061-
dll_name = yr_get_string(module, "delayed_import_details[%i].library_name", i);
3071+
dll_name = yr_get_string(
3072+
module, "delayed_import_details[%i].library_name", i);
30623073
if (dll_name == NULL || IS_UNDEFINED(dll_name) ||
30633074
ss_compare(in_dll_name, dll_name) != 0)
30643075
continue;
@@ -3103,7 +3114,8 @@ define_function(delayed_import_rva_ordinal)
31033114

31043115
for (int i = 0; i < num_imports; i++)
31053116
{
3106-
dll_name = yr_get_string(module, "delayed_import_details[%i].library_name", i);
3117+
dll_name = yr_get_string(
3118+
module, "delayed_import_details[%i].library_name", i);
31073119
if (dll_name == NULL || IS_UNDEFINED(dll_name) ||
31083120
ss_compare(in_dll_name, dll_name) != 0)
31093121
continue;
@@ -3148,7 +3160,8 @@ define_function(locale)
31483160

31493161
for (int i = 0; i < n; i++)
31503162
{
3151-
uint64_t rsrc_language = yr_get_integer(module, "resources[%i].language", i);
3163+
uint64_t rsrc_language = yr_get_integer(
3164+
module, "resources[%i].language", i);
31523165

31533166
if ((rsrc_language & 0xFFFF) == locale)
31543167
return_integer(1);
@@ -3176,7 +3189,8 @@ define_function(language)
31763189

31773190
for (int i = 0; i < n; i++)
31783191
{
3179-
uint64_t rsrc_language = yr_get_integer(module, "resources[%i].language", i);
3192+
uint64_t rsrc_language = yr_get_integer(
3193+
module, "resources[%i].language", i);
31803194

31813195
if ((rsrc_language & 0xFF) == language)
31823196
return_integer(1);
@@ -3754,7 +3768,8 @@ begin_declarations
37543768
declare_string("digest");
37553769
declare_string("file_digest");
37563770
declare_integer("number_of_certificates");
3757-
begin_struct_array("certificates");
3771+
begin_struct_array("certificates")
3772+
;
37583773
declare_string("thumbprint");
37593774
declare_string("issuer");
37603775
declare_string("subject");
@@ -3766,12 +3781,14 @@ begin_declarations
37663781
declare_integer("not_after");
37673782
end_struct_array("certificates");
37683783

3769-
begin_struct("signer_info");
3784+
begin_struct("signer_info")
3785+
;
37703786
declare_string("program_name");
37713787
declare_string("digest");
37723788
declare_string("digest_alg");
37733789
declare_integer("length_of_chain");
3774-
begin_struct_array("chain");
3790+
begin_struct_array("chain")
3791+
;
37753792
declare_string("thumbprint");
37763793
declare_string("issuer");
37773794
declare_string("subject");
@@ -3785,13 +3802,15 @@ begin_declarations
37853802
end_struct("signer_info");
37863803

37873804
declare_integer("number_of_countersignatures");
3788-
begin_struct_array("countersignatures");
3805+
begin_struct_array("countersignatures")
3806+
;
37893807
declare_integer("verified");
37903808
declare_integer("sign_time");
37913809
declare_string("digest_alg");
37923810
declare_string("digest");
37933811
declare_integer("length_of_chain");
3794-
begin_struct_array("chain");
3812+
begin_struct_array("chain")
3813+
;
37953814
declare_string("thumbprint");
37963815
declare_string("issuer");
37973816
declare_string("subject");
@@ -3860,16 +3879,19 @@ int module_load(
38603879
yr_set_integer(IMAGE_FILE_MACHINE_M32R, module_object, "MACHINE_M32R");
38613880
yr_set_integer(IMAGE_FILE_MACHINE_MIPS16, module_object, "MACHINE_MIPS16");
38623881
yr_set_integer(IMAGE_FILE_MACHINE_MIPSFPU, module_object, "MACHINE_MIPSFPU");
3863-
yr_set_integer(IMAGE_FILE_MACHINE_MIPSFPU16, module_object, "MACHINE_MIPSFPU16");
3882+
yr_set_integer(
3883+
IMAGE_FILE_MACHINE_MIPSFPU16, module_object, "MACHINE_MIPSFPU16");
38643884
yr_set_integer(IMAGE_FILE_MACHINE_POWERPC, module_object, "MACHINE_POWERPC");
3865-
yr_set_integer(IMAGE_FILE_MACHINE_POWERPCFP, module_object, "MACHINE_POWERPCFP");
3885+
yr_set_integer(
3886+
IMAGE_FILE_MACHINE_POWERPCFP, module_object, "MACHINE_POWERPCFP");
38663887
yr_set_integer(IMAGE_FILE_MACHINE_R4000, module_object, "MACHINE_R4000");
38673888
yr_set_integer(IMAGE_FILE_MACHINE_SH3, module_object, "MACHINE_SH3");
38683889
yr_set_integer(IMAGE_FILE_MACHINE_SH3DSP, module_object, "MACHINE_SH3DSP");
38693890
yr_set_integer(IMAGE_FILE_MACHINE_SH4, module_object, "MACHINE_SH4");
38703891
yr_set_integer(IMAGE_FILE_MACHINE_SH5, module_object, "MACHINE_SH5");
38713892
yr_set_integer(IMAGE_FILE_MACHINE_THUMB, module_object, "MACHINE_THUMB");
3872-
yr_set_integer(IMAGE_FILE_MACHINE_WCEMIPSV2, module_object, "MACHINE_WCEMIPSV2");
3893+
yr_set_integer(
3894+
IMAGE_FILE_MACHINE_WCEMIPSV2, module_object, "MACHINE_WCEMIPSV2");
38733895
yr_set_integer(
38743896
IMAGE_FILE_MACHINE_TARGET_HOST, module_object, "MACHINE_TARGET_HOST");
38753897
yr_set_integer(IMAGE_FILE_MACHINE_R3000, module_object, "MACHINE_R3000");
@@ -3889,7 +3911,8 @@ int module_load(
38893911
yr_set_integer(
38903912
IMAGE_SUBSYSTEM_WINDOWS_CUI, module_object, "SUBSYSTEM_WINDOWS_CUI");
38913913
yr_set_integer(IMAGE_SUBSYSTEM_OS2_CUI, module_object, "SUBSYSTEM_OS2_CUI");
3892-
yr_set_integer(IMAGE_SUBSYSTEM_POSIX_CUI, module_object, "SUBSYSTEM_POSIX_CUI");
3914+
yr_set_integer(
3915+
IMAGE_SUBSYSTEM_POSIX_CUI, module_object, "SUBSYSTEM_POSIX_CUI");
38933916
yr_set_integer(
38943917
IMAGE_SUBSYSTEM_NATIVE_WINDOWS,
38953918
module_object,
@@ -3928,41 +3951,48 @@ int module_load(
39283951
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY,
39293952
module_object,
39303953
"FORCE_INTEGRITY");
3931-
yr_set_integer(IMAGE_DLLCHARACTERISTICS_NX_COMPAT, module_object, "NX_COMPAT");
3954+
yr_set_integer(
3955+
IMAGE_DLLCHARACTERISTICS_NX_COMPAT, module_object, "NX_COMPAT");
39323956
yr_set_integer(
39333957
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION, module_object, "NO_ISOLATION");
39343958
yr_set_integer(IMAGE_DLLCHARACTERISTICS_NO_SEH, module_object, "NO_SEH");
39353959
yr_set_integer(IMAGE_DLLCHARACTERISTICS_NO_BIND, module_object, "NO_BIND");
39363960
yr_set_integer(
39373961
IMAGE_DLLCHARACTERISTICS_APPCONTAINER, module_object, "APPCONTAINER");
3938-
yr_set_integer(IMAGE_DLLCHARACTERISTICS_WDM_DRIVER, module_object, "WDM_DRIVER");
3962+
yr_set_integer(
3963+
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER, module_object, "WDM_DRIVER");
39393964
yr_set_integer(IMAGE_DLLCHARACTERISTICS_GUARD_CF, module_object, "GUARD_CF");
39403965
yr_set_integer(
39413966
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE,
39423967
module_object,
39433968
"TERMINAL_SERVER_AWARE");
39443969

39453970
yr_set_integer(IMAGE_FILE_RELOCS_STRIPPED, module_object, "RELOCS_STRIPPED");
3946-
yr_set_integer(IMAGE_FILE_EXECUTABLE_IMAGE, module_object, "EXECUTABLE_IMAGE");
3971+
yr_set_integer(
3972+
IMAGE_FILE_EXECUTABLE_IMAGE, module_object, "EXECUTABLE_IMAGE");
39473973
yr_set_integer(
39483974
IMAGE_FILE_LINE_NUMS_STRIPPED, module_object, "LINE_NUMS_STRIPPED");
39493975
yr_set_integer(
39503976
IMAGE_FILE_LOCAL_SYMS_STRIPPED, module_object, "LOCAL_SYMS_STRIPPED");
3951-
yr_set_integer(IMAGE_FILE_AGGRESIVE_WS_TRIM, module_object, "AGGRESIVE_WS_TRIM");
3977+
yr_set_integer(
3978+
IMAGE_FILE_AGGRESIVE_WS_TRIM, module_object, "AGGRESIVE_WS_TRIM");
39523979
yr_set_integer(
39533980
IMAGE_FILE_LARGE_ADDRESS_AWARE, module_object, "LARGE_ADDRESS_AWARE");
3954-
yr_set_integer(IMAGE_FILE_BYTES_REVERSED_LO, module_object, "BYTES_REVERSED_LO");
3981+
yr_set_integer(
3982+
IMAGE_FILE_BYTES_REVERSED_LO, module_object, "BYTES_REVERSED_LO");
39553983
yr_set_integer(IMAGE_FILE_32BIT_MACHINE, module_object, "MACHINE_32BIT");
39563984
yr_set_integer(IMAGE_FILE_DEBUG_STRIPPED, module_object, "DEBUG_STRIPPED");
39573985
yr_set_integer(
39583986
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP,
39593987
module_object,
39603988
"REMOVABLE_RUN_FROM_SWAP");
3961-
yr_set_integer(IMAGE_FILE_NET_RUN_FROM_SWAP, module_object, "NET_RUN_FROM_SWAP");
3989+
yr_set_integer(
3990+
IMAGE_FILE_NET_RUN_FROM_SWAP, module_object, "NET_RUN_FROM_SWAP");
39623991
yr_set_integer(IMAGE_FILE_SYSTEM, module_object, "SYSTEM");
39633992
yr_set_integer(IMAGE_FILE_DLL, module_object, "DLL");
39643993
yr_set_integer(IMAGE_FILE_UP_SYSTEM_ONLY, module_object, "UP_SYSTEM_ONLY");
3965-
yr_set_integer(IMAGE_FILE_BYTES_REVERSED_HI, module_object, "BYTES_REVERSED_HI");
3994+
yr_set_integer(
3995+
IMAGE_FILE_BYTES_REVERSED_HI, module_object, "BYTES_REVERSED_HI");
39663996

39673997
yr_set_integer(
39683998
IMAGE_DIRECTORY_ENTRY_EXPORT,
@@ -4056,17 +4086,21 @@ int module_load(
40564086
IMAGE_SCN_NO_DEFER_SPEC_EXC, module_object, "SECTION_NO_DEFER_SPEC_EXC");
40574087
yr_set_integer(IMAGE_SCN_GPREL, module_object, "SECTION_GPREL");
40584088
yr_set_integer(IMAGE_SCN_MEM_FARDATA, module_object, "SECTION_MEM_FARDATA");
4059-
yr_set_integer(IMAGE_SCN_MEM_PURGEABLE, module_object, "SECTION_MEM_PURGEABLE");
4089+
yr_set_integer(
4090+
IMAGE_SCN_MEM_PURGEABLE, module_object, "SECTION_MEM_PURGEABLE");
40604091
yr_set_integer(IMAGE_SCN_MEM_16BIT, module_object, "SECTION_MEM_16BIT");
40614092
yr_set_integer(IMAGE_SCN_MEM_LOCKED, module_object, "SECTION_MEM_LOCKED");
40624093
yr_set_integer(IMAGE_SCN_MEM_PRELOAD, module_object, "SECTION_MEM_PRELOAD");
40634094
yr_set_integer(IMAGE_SCN_ALIGN_1BYTES, module_object, "SECTION_ALIGN_1BYTES");
40644095
yr_set_integer(IMAGE_SCN_ALIGN_2BYTES, module_object, "SECTION_ALIGN_2BYTES");
40654096
yr_set_integer(IMAGE_SCN_ALIGN_4BYTES, module_object, "SECTION_ALIGN_4BYTES");
40664097
yr_set_integer(IMAGE_SCN_ALIGN_8BYTES, module_object, "SECTION_ALIGN_8BYTES");
4067-
yr_set_integer(IMAGE_SCN_ALIGN_16BYTES, module_object, "SECTION_ALIGN_16BYTES");
4068-
yr_set_integer(IMAGE_SCN_ALIGN_32BYTES, module_object, "SECTION_ALIGN_32BYTES");
4069-
yr_set_integer(IMAGE_SCN_ALIGN_64BYTES, module_object, "SECTION_ALIGN_64BYTES");
4098+
yr_set_integer(
4099+
IMAGE_SCN_ALIGN_16BYTES, module_object, "SECTION_ALIGN_16BYTES");
4100+
yr_set_integer(
4101+
IMAGE_SCN_ALIGN_32BYTES, module_object, "SECTION_ALIGN_32BYTES");
4102+
yr_set_integer(
4103+
IMAGE_SCN_ALIGN_64BYTES, module_object, "SECTION_ALIGN_64BYTES");
40704104
yr_set_integer(
40714105
IMAGE_SCN_ALIGN_128BYTES, module_object, "SECTION_ALIGN_128BYTES");
40724106
yr_set_integer(
@@ -4088,7 +4122,8 @@ int module_load(
40884122
IMAGE_SCN_MEM_DISCARDABLE, module_object, "SECTION_MEM_DISCARDABLE");
40894123
yr_set_integer(
40904124
IMAGE_SCN_MEM_NOT_CACHED, module_object, "SECTION_MEM_NOT_CACHED");
4091-
yr_set_integer(IMAGE_SCN_MEM_NOT_PAGED, module_object, "SECTION_MEM_NOT_PAGED");
4125+
yr_set_integer(
4126+
IMAGE_SCN_MEM_NOT_PAGED, module_object, "SECTION_MEM_NOT_PAGED");
40924127
yr_set_integer(IMAGE_SCN_MEM_SHARED, module_object, "SECTION_MEM_SHARED");
40934128
yr_set_integer(IMAGE_SCN_MEM_EXECUTE, module_object, "SECTION_MEM_EXECUTE");
40944129
yr_set_integer(IMAGE_SCN_MEM_READ, module_object, "SECTION_MEM_READ");
@@ -4115,13 +4150,15 @@ int module_load(
41154150
yr_set_integer(RESOURCE_TYPE_VERSION, module_object, "RESOURCE_TYPE_VERSION");
41164151
yr_set_integer(
41174152
RESOURCE_TYPE_DLGINCLUDE, module_object, "RESOURCE_TYPE_DLGINCLUDE");
4118-
yr_set_integer(RESOURCE_TYPE_PLUGPLAY, module_object, "RESOURCE_TYPE_PLUGPLAY");
4153+
yr_set_integer(
4154+
RESOURCE_TYPE_PLUGPLAY, module_object, "RESOURCE_TYPE_PLUGPLAY");
41194155
yr_set_integer(RESOURCE_TYPE_VXD, module_object, "RESOURCE_TYPE_VXD");
41204156
yr_set_integer(
41214157
RESOURCE_TYPE_ANICURSOR, module_object, "RESOURCE_TYPE_ANICURSOR");
41224158
yr_set_integer(RESOURCE_TYPE_ANIICON, module_object, "RESOURCE_TYPE_ANIICON");
41234159
yr_set_integer(RESOURCE_TYPE_HTML, module_object, "RESOURCE_TYPE_HTML");
4124-
yr_set_integer(RESOURCE_TYPE_MANIFEST, module_object, "RESOURCE_TYPE_MANIFEST");
4160+
yr_set_integer(
4161+
RESOURCE_TYPE_MANIFEST, module_object, "RESOURCE_TYPE_MANIFEST");
41254162

41264163
yr_set_integer(
41274164
IMAGE_DEBUG_TYPE_UNKNOWN, module_object, "IMAGE_DEBUG_TYPE_UNKNOWN");
@@ -4132,7 +4169,8 @@ int module_load(
41324169
yr_set_integer(IMAGE_DEBUG_TYPE_MISC, module_object, "IMAGE_DEBUG_TYPE_MISC");
41334170
yr_set_integer(
41344171
IMAGE_DEBUG_TYPE_EXCEPTION, module_object, "IMAGE_DEBUG_TYPE_EXCEPTION");
4135-
yr_set_integer(IMAGE_DEBUG_TYPE_FIXUP, module_object, "IMAGE_DEBUG_TYPE_FIXUP");
4172+
yr_set_integer(
4173+
IMAGE_DEBUG_TYPE_FIXUP, module_object, "IMAGE_DEBUG_TYPE_FIXUP");
41364174
yr_set_integer(
41374175
IMAGE_DEBUG_TYPE_OMAP_TO_SRC,
41384176
module_object,
@@ -4147,15 +4185,18 @@ int module_load(
41474185
IMAGE_DEBUG_TYPE_RESERVED10,
41484186
module_object,
41494187
"IMAGE_DEBUG_TYPE_RESERVED10");
4150-
yr_set_integer(IMAGE_DEBUG_TYPE_CLSID, module_object, "IMAGE_DEBUG_TYPE_CLSID");
4188+
yr_set_integer(
4189+
IMAGE_DEBUG_TYPE_CLSID, module_object, "IMAGE_DEBUG_TYPE_CLSID");
41514190
yr_set_integer(
41524191
IMAGE_DEBUG_TYPE_VC_FEATURE,
41534192
module_object,
41544193
"IMAGE_DEBUG_TYPE_VC_FEATURE");
41554194
yr_set_integer(IMAGE_DEBUG_TYPE_POGO, module_object, "IMAGE_DEBUG_TYPE_POGO");
4156-
yr_set_integer(IMAGE_DEBUG_TYPE_ILTCG, module_object, "IMAGE_DEBUG_TYPE_ILTCG");
4195+
yr_set_integer(
4196+
IMAGE_DEBUG_TYPE_ILTCG, module_object, "IMAGE_DEBUG_TYPE_ILTCG");
41574197
yr_set_integer(IMAGE_DEBUG_TYPE_MPX, module_object, "IMAGE_DEBUG_TYPE_MPX");
4158-
yr_set_integer(IMAGE_DEBUG_TYPE_REPRO, module_object, "IMAGE_DEBUG_TYPE_REPRO");
4198+
yr_set_integer(
4199+
IMAGE_DEBUG_TYPE_REPRO, module_object, "IMAGE_DEBUG_TYPE_REPRO");
41594200

41604201
yr_set_integer(0, module_object, "is_pe");
41614202

0 commit comments

Comments
 (0)