Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

32bit has some problems #12

Open
lld1995 opened this issue Jul 24, 2023 · 0 comments
Open

32bit has some problems #12

lld1995 opened this issue Jul 24, 2023 · 0 comments

Comments

@lld1995
Copy link

lld1995 commented Jul 24, 2023

// The YR_ARENA_REF must be 64-bits long because this structure occupies
// the place of relocatable pointers when arenas are saved to file. The pack(4)
// directive ensures that fields are aligned to 4-byte boundaries and the total
// size of the structure is 8 bytes. When compiling YARA for 32-bits, pointers
// are 4 bytes but this structure is still 8 bytes. For that reason structures
// that are saved in arenas must declare pointers using the DECLARE_REFERENCE
// macro, which ensures that 8 bytes are reserved for the pointer no matter if
// they are 32-bits pointers.

#pragma pack(push)
#pragma pack(4)

struct YR_ARENA_REF
{
uint32_t buffer_id;
yr_arena_off_t offset;
};

#pragma pack(pop)

#define DECLARE_REFERENCE(type, name)
union
{
type name;
YR_ARENA_REF name##_;
} YR_ALIGN(8)

DECLARE_REFERENCE in yara can't define as intptr, because intptr will not work on 32bit program

i see that YR_RULE , YR_META and more struct have this issue

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant