PE module¶

The PE module allows you to create more fine-grained rules for PE files by using attributes and features of the PE file format. This module exposes most of the fields present in a PE header and provides functions which can be used to write more expressive and targeted rules. Let's see some examples:

import "pe"

rule single_section
{
    condition:
        pe.number_of_sections == 1
}

rule control_panel_applet
{
    condition:
        pe.exports("CPlApplet")
}

rule is_dll
{
    condition:
        pe.characteristics & pe.DLL
}

rule is_pe
{
    condition:
        pe.is_pe
}

Reference¶

type machine

Changed in version 3.3.0.

Integer with one of the following values:

type MACHINE_UNKNOWN¶

type MACHINE_AM33¶

type MACHINE_AMD64¶

type MACHINE_ARM¶

type MACHINE_ARMNT¶

type MACHINE_ARM64¶

type MACHINE_EBC¶

type MACHINE_I386¶

type MACHINE_IA64¶

type MACHINE_M32R¶

type MACHINE_MIPS16¶

type MACHINE_MIPSFPU¶

type MACHINE_MIPSFPU16¶

type MACHINE_POWERPC¶

type MACHINE_POWERPCFP¶

type MACHINE_R4000¶

type MACHINE_SH3¶

type MACHINE_SH3DSP¶

type MACHINE_SH4¶

type MACHINE_SH5¶

type MACHINE_THUMB¶

type MACHINE_WCEMIPSV2¶

type MACHINE_TARGET_HOST¶

type MACHINE_R3000¶

type MACHINE_R10000¶

type MACHINE_ALPHA¶

type MACHINE_SH3E¶

type MACHINE_ALPHA64¶

type MACHINE_AXP64¶

type MACHINE_TRICORE¶

type MACHINE_CEF¶

type MACHINE_CEE¶

Example: pe.machine == pe.MACHINE_AMD64

type checksum¶: New in version 3.6.0.

Integer with the "PE checksum" as stored in the OptionalHeader

type calculate_checksum¶

New in version 3.6.0.

Function that calculates the "PE checksum"

Example: pe.checksum == pe.calculate_checksum()

type subsystem¶

Integer with one of the following values:

type SUBSYSTEM_UNKNOWN¶

type SUBSYSTEM_NATIVE¶

type SUBSYSTEM_WINDOWS_GUI¶

type SUBSYSTEM_WINDOWS_CUI¶

type SUBSYSTEM_OS2_CUI¶

type SUBSYSTEM_POSIX_CUI¶

type SUBSYSTEM_NATIVE_WINDOWS¶

type SUBSYSTEM_WINDOWS_CE_GUI¶

type SUBSYSTEM_EFI_APPLICATION¶

type SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER¶

type SUBSYSTEM_EFI_RUNTIME_DRIVER¶

type SUBSYSTEM_EFI_ROM_IMAGE¶

type SUBSYSTEM_XBOX¶

type SUBSYSTEM_WINDOWS_BOOT_APPLICATION¶

Example: pe.subsystem == pe.SUBSYSTEM_NATIVE

type timestamp¶

PE timestamp, as an epoch integer.

Example: pe.timestamp >= 1424563200

type pointer_to_symbol_table¶: New in version 3.8.0.

Value of IMAGE_FILE_HEADER::PointerToSymbolTable. Used when the PE image has COFF debug info.

type number_of_symbols¶: New in version 3.8.0.

Value of IMAGE_FILE_HEADER::NumberOfSymbols. Used when the PE image has COFF debug info.

type size_of_optional_header¶: New in version 3.8.0.

Value of IMAGE_FILE_HEADER::SizeOfOptionalHeader. This is real size of the optional header and reflects differences between 32-bit and 64-bit optional header and number of data directories.

type opthdr_magic¶

New in version 3.8.0.

Value of IMAGE_OPTIONAL_HEADER::Magic.

Integer with one of the following values:

type IMAGE_NT_OPTIONAL_HDR32_MAGIC¶

type IMAGE_NT_OPTIONAL_HDR64_MAGIC¶

type IMAGE_ROM_OPTIONAL_HDR_MAGIC¶

type size_of_code¶: New in version 3.8.0.

Value of IMAGE_OPTIONAL_HEADER::SizeOfCode. This is the sum of raw data sizes in code sections.

type size_of_initialized_data¶: New in version 3.8.0.

Value of IMAGE_OPTIONAL_HEADER::SizeOfInitializedData.

type size_of_uninitialized_data¶: Value of IMAGE_OPTIONAL_HEADER::SizeOfUninitializedData.

type entry_point: Entry point file offset or virtual address depending on whether YARA is scanning a file or process memory respectively. This is equivalent to the deprecated entrypoint keyword.

type entry_point_raw¶: Entry point raw value from the optional header of the PE. This value is not converted to a file offset or an RVA.

New in version 4.1.0.

type base_of_code¶: New in version 3.8.0.

Value of IMAGE_OPTIONAL_HEADER::BaseOfCode.

type base_of_data¶: New in version 3.8.0.

Value of IMAGE_OPTIONAL_HEADER::BaseOfData. This field only exists in 32-bit PE files.

type image_base¶: Image base relative virtual address.

type section_alignment¶: New in version 3.8.0.

Value of IMAGE_OPTIONAL_HEADER::SectionAlignment. When Windows maps a PE image to memory, all raw sizes (including size of header) are aligned up to this value.

type file_alignment¶: New in version 3.8.0.

Value of IMAGE_OPTIONAL_HEADER::FileAlignment. All raw data sizes of sections in the PE image are aligned to this value.

type win32_version_value¶: New in version 3.8.0.

Value of IMAGE_OPTIONAL_HEADER::Win32VersionValue.

type size_of_image¶: New in version 3.8.0.

Value of IMAGE_OPTIONAL_HEADER::SizeOfImage. This is the total virtual size of header and all sections.

type size_of_headers¶: New in version 3.8.0.

Value of IMAGE_OPTIONAL_HEADER::SizeOfHeaders. This is the raw data size of the PE headers including DOS header, file header, optional header and all section headers. When PE is mapped to memory, this value is subject to aligning up to SectionAlignment.

type characteristics¶

Bitmap with PE FileHeader characteristics. Individual characteristics can be inspected by performing a bitwise AND operation with the following constants:

type RELOCS_STRIPPED¶: Relocation info stripped from file.

type EXECUTABLE_IMAGE¶: File is executable (i.e. no unresolved external references).

type LINE_NUMS_STRIPPED¶: Line numbers stripped from file.

type LOCAL_SYMS_STRIPPED¶: Local symbols stripped from file.

type AGGRESIVE_WS_TRIM¶: Aggressively trim working set

type LARGE_ADDRESS_AWARE¶: App can handle >2gb addresses

type BYTES_REVERSED_LO¶: Bytes of machine word are reversed.

type MACHINE_32BIT¶: 32 bit word machine.

type DEBUG_STRIPPED¶: Debugging info stripped from file in .DBG file

type REMOVABLE_RUN_FROM_SWAP¶: If Image is on removable media, copy and run from the swap file.

type NET_RUN_FROM_SWAP¶: If Image is on Net, copy and run from the swap file.

type SYSTEM¶: System File.

type DLL¶: File is a DLL.

type UP_SYSTEM_ONLY¶: File should only be run on a UP machine

type BYTES_REVERSED_HI¶: Bytes of machine word are reversed.

Example: pe.characteristics & pe.DLL

type linker_version¶

An object with two integer attributes, one for each major and minor linker version.

major: Major linker version.

minor: Minor linker version.

type os_version¶

An object with two integer attributes, one for each major and minor OS version.

major: Major OS version.

minor: Minor OS version.

type image_version¶

An object with two integer attributes, one for each major and minor image version.

major: Major image version.

minor: Minor image version.

type subsystem_version¶

An object with two integer attributes, one for each major and minor subsystem version.

major