fix: keep proper magic value in macho module

This matches the VirusTotal/yara#2041 fix done in yara 4.5.0
vthib · Feb 16, 2024 · 37d73a6 · 37d73a6
1 parent 51e27fd
commit 37d73a6
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 1 deletion.
diff --git a/boreal/src/module/macho.rs b/boreal/src/module/macho.rs
@@ -833,7 +833,7 @@ fn parse_header<Mach: MachHeader<Endian = Endianness>>(
     }
 
     [
-        ("magic", header.magic().to_be().into()),
+        ("magic", header.magic().into()),
         ("cputype", cputype.into()),
         ("cpusubtype", cpusubtype.into()),
         ("filetype", header.filetype(e).into()),

diff --git a/boreal/tests/it/libyara_compat/macho.rs b/boreal/tests/it/libyara_compat/macho.rs
@@ -284,6 +284,14 @@ fn test_macho() {
         true,
     );
 
+    check_file(
+        "import \"macho\" rule test { condition:
+    macho.file[0].magic == 0xcefaedfe and
+    macho.file[1].magic == 0xcffaedfe }",
+        "tests/assets/libyara/data/tiny-universal",
+        true,
+    );
+
     // Entry points for files (LC_MAIN)
 
     check_file(