rva_map_yara.lmod

LOADREL yara

DEFINE FILESIZE 500

INPUT HEADER FILESIZE
INPUT RVA 4
OUTPUT VAL 1
OUTPUT ERROR 1

P: sectOff <- SECT HEADER
P: nSect <- NSECT HEADER
P: optHdr <- OPTHDR HEADER as IMAGE_OPTIONAL_HEADER32

P: notFound <- INT 0 (sizeof IMAGE_SECTION_HEADER)
P: found <- notFound as IMAGE_SECTION_HEADER

P: lowestRVA <- INT 0xffffffff 4
P: sectAl <- optHdr.SectionAlignment
L1: sect <- LOOP(HEADER, sectOff, (sizeof IMAGE_SECTION_HEADER), nSect, 5) AS IMAGE_SECTION_HEADER
    P: SRVA <- ADD optHdr.ImageBase sect.VirtualAddress
    V1: ULT SRVA lowestRVA
    P(V1): lowestRVA <- SRVA
    P: ERVA <- ALIGNUP (ADD SRVA sect.VirtualSize) sectAl
    V2: AND (ULE SRVA RVA) (UGT ERVA RVA)
    P(V2): found <- sect
END L1

V2: ULT RVA lowestRVA
V3(V2): ULT RVA FILESIZE
V4(V2, !V3): EQ ERROR 1 term
V5(V3): EQ VAL HEADER[RVA, 1] term
V6(V3): EQ ERROR 0 term

V7(!V2): NEQ found notFound
V8(!V2, !V7): EQ ERROR 1 term
P: sOff <- SUB RVA found.VirtualAddress
V9(V7): ULT sOff found.SizeOfRawData
V10(V7, !V9): EQ ERROR 1 term
V11(V9): EQ ERROR 0 term
V12(V9): EQ VAL HEADER[ADD sOff found.PointerToRawData, 1] term