diff --git a/boreal/src/module/pe.rs b/boreal/src/module/pe.rs index 8f2193c0..6afcb480 100644 --- a/boreal/src/module/pe.rs +++ b/boreal/src/module/pe.rs @@ -1188,6 +1188,7 @@ impl Pe { "entry_point", sections .and_then(|sections| va_to_file_offset(mem, §ions, ep)) + .map_or(-1, i64::from) .into(), ), ("entry_point_raw", ep.into()), diff --git a/boreal/tests/it/pe.rs b/boreal/tests/it/pe.rs index be0d02b2..79fde99e 100644 --- a/boreal/tests/it/pe.rs +++ b/boreal/tests/it/pe.rs @@ -272,8 +272,6 @@ fn test_coverage_pe_libyara_33fc70f9() { 33fc70f99be6d2833ae48852d611c8048d0c053ed0b2c626db4dbe902832a08b", &[ "pe.rich_signature", - // FIXME: this difference should not be - "pe.entry_point", #[cfg(not(feature = "authenticode"))] "pe.number_of_signatures", ], @@ -491,6 +489,20 @@ fn test_coverage_pe_1561_32_section1() { ); } +#[test] +fn test_coverage_pe_c6f9709f() { + compare_module_values_on_file( + Pe::default(), + "tests/assets/libyara/data/\ + c6f9709feccf42f2d9e22057182fe185f177fb9daaa2649b4669a24f2ee7e3ba_0h_410h", + &[ + "pe.rich_signature", + #[cfg(not(feature = "authenticode"))] + "pe.number_of_signatures", + ], + ); +} + #[test] #[cfg(feature = "hash")] fn test_imphash() {