pe.version_info when RT_VERSION doesn't exist

[djlukic]

Hi,

I am having a weird situation where I am trying to match a sample where in condition I specified
and not pe.version_info["FileDescription"] == "Test"
and I also tried with
pe.version_info["FileDescription"] != "Test"
but it doesn't hit because RT_VERSION resource doesn't exist.
Is this intended that and not or != won't have a match when RT_VERSION doesn't exist?

Thanks!

[cherepanov74]

version_info can be YR_UNDEFINED,
Try to use something like this:
and (not defined pe.version_info["FileDescription"] or not (pe.version_info["FileDescription"] matches /Test/) )

[djlukic]

Thank you!