diff --git a/boreal/src/module/macho.rs b/boreal/src/module/macho.rs index bd75df03..946c1380 100644 --- a/boreal/src/module/macho.rs +++ b/boreal/src/module/macho.rs @@ -833,7 +833,7 @@ fn parse_header>( } [ - ("magic", header.magic().to_be().into()), + ("magic", header.magic().into()), ("cputype", cputype.into()), ("cpusubtype", cpusubtype.into()), ("filetype", header.filetype(e).into()), diff --git a/boreal/tests/it/libyara_compat/macho.rs b/boreal/tests/it/libyara_compat/macho.rs index 2f03ff2d..1f70d4a0 100644 --- a/boreal/tests/it/libyara_compat/macho.rs +++ b/boreal/tests/it/libyara_compat/macho.rs @@ -284,6 +284,14 @@ fn test_macho() { true, ); + check_file( + "import \"macho\" rule test { condition: + macho.file[0].magic == 0xcefaedfe and + macho.file[1].magic == 0xcffaedfe }", + "tests/assets/libyara/data/tiny-universal", + true, + ); + // Entry points for files (LC_MAIN) check_file(