Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/jsiwek/fix-pe-major-subsys'

Browse source 
* origin/topic/jsiwek/fix-pe-major-subsys:
  Fix `major_subsys_version` field in `pe_optional_header` event
This commit is contained in:
Jon Siwek 2021-02-16 11:10:40 -08:00
commit ba46ed25d9
3 changed files with 9 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
CHANGES
View file

@ -1,4 +1,11 @@
4.1.0-dev.228 | 2021-02-16 11:10:40 -0800
* Fix `major_subsys_version` field in `pe_optional_header` event
It was incorrectly set the same as the `minor_subsys_version` field
of the `PE::OptionalHeader` record. (Jon Siwek, Corelight)
4.1.0-dev.225 | 2021-02-12 14:40:14 -0800 4.1.0-dev.225 | 2021-02-12 14:40:14 -0800
* Fix CentOS 8 CI Dockerfile (Jon Siwek, Corelight) * Fix CentOS 8 CI Dockerfile (Jon Siwek, Corelight)

2
VERSION
View file

@ -1 +1 @@
4.1.0-dev.225 4.1.0-dev.228

2
src/file_analysis/analyzer/pe/pe-analyzer.pac
View file

@ -146,7 +146,7 @@ refine flow File += {
oh->Assign(13, zeek::val_mgr->Count(${h.os_version_minor})); oh->Assign(13, zeek::val_mgr->Count(${h.os_version_minor}));
oh->Assign(14, zeek::val_mgr->Count(${h.major_image_version})); oh->Assign(14, zeek::val_mgr->Count(${h.major_image_version}));
oh->Assign(15, zeek::val_mgr->Count(${h.minor_image_version})); oh->Assign(15, zeek::val_mgr->Count(${h.minor_image_version}));
oh->Assign(16, zeek::val_mgr->Count(${h.minor_subsys_version})); oh->Assign(16, zeek::val_mgr->Count(${h.major_subsys_version}));
oh->Assign(17, zeek::val_mgr->Count(${h.minor_subsys_version})); oh->Assign(17, zeek::val_mgr->Count(${h.minor_subsys_version}));
oh->Assign(18, zeek::val_mgr->Count(${h.size_of_image})); oh->Assign(18, zeek::val_mgr->Count(${h.size_of_image}));
oh->Assign(19, zeek::val_mgr->Count(${h.size_of_headers})); oh->Assign(19, zeek::val_mgr->Count(${h.size_of_headers}));