Error in signatures detection

[hasherezade]

Example (from unpacking by Athracene):

Both files have been packed with UPX.

Signature that should match:

UPX_old
48
60 BE 00 ?? ?? ?? 8D BE 00 ?? ?? FF 57 83 CD FF
EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB
75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00

If this is the only signature loaded, both are detected properly. But in case if there are other signatures, only one is detected.

The reason is, there is another signature that overshadows the matching one.

Once the character that is not a wildcard is matched (here at position 3: 60 BE 00 _A0_), the signature with the wildcard is completely dropped.
This is an invalid behavior, and the signature with the wildcards should be still kept for the comparisons.

[hasherezade]

After the fixes, both files are detected:

[hasherezade]

fixed in the latest release:

• https://github.com/hasherezade/pe-bear/releases/tag/v0.6.5