Improve PE module when scanning memory and fix PE certificate parsing

configure.ac

@@ -52,6 +52,7 @@ case $host_os in
              proc_interface=mach
              jemalloc_prefix=je_ ;;
     mingw*|cygwin*) CFLAGS="$CFLAGS -DUSE_WINDOWS_PROC"
+            LDFLAGS="$LDFLAGS -lntdll"
             proc_interface=windows
             jemalloc_prefix= ;;
     linux*|netbsd*|dragonfly*|kfreebsd*)

libyara/include/yara/pe_utils.h

@@ -51,6 +51,8 @@ typedef struct _PE
 {
   const uint8_t* data;
   size_t data_size;
+  YR_MEMORY_REGION* region;
+  int memory;
 
   union
   {
@@ -68,13 +70,42 @@ typedef struct _PE
 
 } PE;
 
-#define fits_in_pe(pe, pointer, size)                                     \
-  ((size_t)(size) <= pe->data_size && (uint8_t*) (pointer) >= pe->data && \
-   (uint8_t*) (pointer) <= pe->data + pe->data_size - (size))
+#define fits_in_pe(pe, pointer, size) \
+(pe->memory ? \
+  ((size_t)size <= pe->region->data_size && \
+    pe->region->block_count > 0 && \
+    (uint8_t*)(pointer) >= (uint8_t*)pe->region->blocks[0].context && \
+    (uint8_t*)(pointer) <= (uint8_t*)pe->region->blocks[0].context + pe->region->data_size - size) : \
+  ((size_t)size <= pe->data_size && \
+    (uint8_t*)(pointer) >= pe->data && \
+    (uint8_t*)(pointer) <= pe->data + pe->data_size - size))
 
 #define struct_fits_in_pe(pe, pointer, struct_type) \
   fits_in_pe(pe, pointer, sizeof(struct_type))
 
+#define get_data_pointer_memory(pe, offset, value, type) \
+for (uint8_t i = 0; i < pe->region->block_count; i++) \
+{ \
+  if (offset >= pe->region->blocks[i].base && \
+    offset < pe->region->blocks[i].base + pe->region->blocks[i].size) \
+  { \
+    value = (type)((uint8_t*)pe->region->blocks[i].context + (offset - pe->region->blocks[i].base)); \
+    break; \
+  } \
+}
+
+#define get_data_pointer_memory_with_size(pe, offset, value, type, maxsize) \
+for (uint8_t i = 0; i < pe->region->block_count; i++) \
+{ \
+  if (offset >= pe->region->blocks[i].base && \
+    offset < pe->region->blocks[i].base + pe->region->blocks[i].size) \
+  { \
+    value = (type)((uint8_t*)pe->region->blocks[i].context + (offset - pe->region->blocks[i].base)); \
+        maxsize = pe->region->blocks[i].size - (offset - pe->region->blocks[i].base); \
+    break; \
+  } \
+}
+
 PIMAGE_NT_HEADERS32 pe_get_header(const uint8_t* data, size_t data_size);
 
 PIMAGE_DATA_DIRECTORY pe_get_directory_entry(PE* pe, int entry);

libyara/include/yara/types.h

@@ -201,6 +201,7 @@ typedef struct YR_MODULE_IMPORT YR_MODULE_IMPORT;
 
 typedef struct YR_MEMORY_BLOCK YR_MEMORY_BLOCK;
 typedef struct YR_MEMORY_BLOCK_ITERATOR YR_MEMORY_BLOCK_ITERATOR;
+typedef struct YR_MEMORY_REGION YR_MEMORY_REGION;
 
 typedef struct YR_MODIFIER YR_MODIFIER;
 
@@ -718,6 +719,13 @@ struct YR_MEMORY_BLOCK_ITERATOR
   // only when they want to report an error.
   int last_error;
 };
+struct YR_MEMORY_REGION {
+  uint8_t block_count;
+  size_t data_size;
+  void* context;
+  YR_MEMORY_BLOCK blocks[32];
+};
+
 
 typedef int (*YR_CALLBACK_FUNC)(
     YR_SCAN_CONTEXT* context,