diff --git a/docs/modules/pe.rst b/docs/modules/pe.rst index 7196d029d1..f7e3c377c1 100644 --- a/docs/modules/pe.rst +++ b/docs/modules/pe.rst @@ -1474,6 +1474,14 @@ Reference *Example: pe.is_pe* +.. c:function:: is_exe() + + .. versionadded:: 4.3.3 + + Function returning true if the PE is a EXE. + + *Example: pe.is_exe()* + .. c:function:: is_dll() .. versionadded:: 3.5.0 diff --git a/libyara/modules/pe/pe.c b/libyara/modules/pe/pe.c index a9c96d9c36..135d6852d8 100644 --- a/libyara/modules/pe/pe.c +++ b/libyara/modules/pe/pe.c @@ -3299,6 +3299,18 @@ define_function(language) return_integer(0); } +define_function(is_exe) +{ + int64_t characteristics; + YR_OBJECT* module = yr_module(); + + if (yr_is_undefined(module, "characteristics")) + return_integer(YR_UNDEFINED); + + characteristics = yr_get_integer(module, "characteristics"); + return_integer(characteristics & IMAGE_FILE_EXECUTABLE_IMAGE); +} + define_function(is_dll) { int64_t characteristics; @@ -3791,6 +3803,7 @@ begin_declarations declare_function("delayed_import_rva", "si", "i", delayed_import_rva_ordinal); declare_function("locale", "i", "i", locale); declare_function("language", "i", "i", language); + declare_function("is_exe", "", "i", is_exe); declare_function("is_dll", "", "i", is_dll); declare_function("is_32bit", "", "i", is_32bit); declare_function("is_64bit", "", "i", is_64bit); diff --git a/tests/oss-fuzz/rules_fuzzer.dict b/tests/oss-fuzz/rules_fuzzer.dict index f53deb7b9d..03903c67f6 100644 --- a/tests/oss-fuzz/rules_fuzzer.dict +++ b/tests/oss-fuzz/rules_fuzzer.dict @@ -98,6 +98,7 @@ "pe.language" "pe.imphash" "pe.section_index" +"pe.is_exe()" "pe.is_dll()" "pe.is_32bit()" "pe.is_64bit()"