Fix endianness issues in macho module #2041
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This is backward compatible change that affects the `magic` field. After this change the value in the `magic` field looks exactly as it looks in the file regardless of the endianness of the current platform, if the file starts with `CA FE BA BE` the value in magic is `0xCAFEBABE`, not `0xBEBAFECA` as it used to be in little-endian architectures.
…platform's endianness.
vthib
added a commit
to vthib/boreal
that referenced
this pull request
Feb 13, 2024
This matches the VirusTotal/yara#2041 fix done in yara 4.5.0
vthib
added a commit
to vthib/boreal
that referenced
this pull request
Feb 16, 2024
This matches the VirusTotal/yara#2041 fix done in yara 4.5.0
vthib
added a commit
to vthib/boreal
that referenced
this pull request
Feb 16, 2024
This matches the VirusTotal/yara#2041 fix done in yara 4.5.0
vthib
added a commit
to vthib/boreal
that referenced
this pull request
Feb 16, 2024
This matches the VirusTotal/yara#2041 fix done in yara 4.5.0
vthib
added a commit
to vthib/boreal
that referenced
this pull request
Feb 16, 2024
This matches the VirusTotal/yara#2041 fix done in yara 4.5.0
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is a backward incompatible change that affects the
macho.magicfield. After this change the value in themagicfield looks exactly as it looks in the file regardless of the endianness of the current platform, if the file starts withCA FE BA BEthe value in magic is0xCAFEBABE, not0xBEBAFECAas it used to be in little-endian architectures.Before this change, the
magicvalue inconsistent between platforms with different endianness.