How can I use pe.entry_point to write YARA rules?

Question

I wrote condition in YARA rule like this pe.entry_point == {12 A5 26} but I am getting unexpected _HEX_STRING_ error. What is the problem? How can I get address of entry_point? What is the type of output of pe.entry_point?

Answer 1

pe.entry_point is a DWORD found in IMAGE_OPTIONAL_HEADER.

The implementation of this function (that is, how Yara retrieves the pe.entry_point value from portable executable files) is available on the Yara Github page.

Regarding the error you encountered, try changing the rule to pe.entry_point == 0x12A526. I'm basing this suggestion off the sample test rule here.

Answer 2

Been 5 years but I believe using the at syntax would work

strings:
  $ep_data = { 12 A5 26 }
condition:
  $ep_data at pe.entry_point