Fix issue #1708

[dangodangodango]

Fix: wrong offset used when checking Version string of .net metadata and AddressOfEntryPoint.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

For more information, open the CLA check for this pull request.

[wxsBSD]

This looks good to me, and thanks for catching it!

[plusvic]

A test case for this issue would be great. Could you add a .NET binary that triggers this issue to tests/data and add a test case to tests/test-dotnet.c.

[dangodangodango]

A test case for this issue would be great. Could you add a .NET binary that triggers this issue to tests/data and add a test case to tests/test-dotnet.c.

OK，I think I can construct one.

[dangodangodango]

A test case for this issue would be great. Could you add a .NET binary that triggers this issue to tests/data and add a test case to tests/test-dotnet.c.

I build a dotnet pe that can triggers this issue: https://github.com/dangodangodango/BadDotnetPe , scanning it with dotnet rule will cause yara to return error 4 (ERROR_COULD_NOT_MAP_FILE). I added it into the testcases.