Include "offset" and "length" in pe.rich_signature and remove "start"
Include "offset" and "length" in pe.rich_signature and remove "start"

By including "offset" and "length" we can compute a hash for the rich signature, which can be a useful way of detecting files. Example:

 hash.md5(pe.rich_signature.offset, pe.rich_signature.length) == "c5d73827a4a2b4f8ca1e6af5de76a7dd"

"start" is not that useful, because it "key" xored with a constant. If you need the value for "start" you can do uint32be(pe.rich_signature.offset)

pombredanne/yara,kallanreed/yara,0x0mar/yara,cblichmann/yara,hillu/yara,neatsun/yara,mgoffin/yara,rayyang2000/yara,0x0mar/yara,msuvajac/yara,MeteorAdminz/yara,MeteorAdminz/yara,pombredanne/yara,smaudet/yara,cblichmann/yara,bmagistro/yara,digideskio/yara,rednaga/yara,pombredanne/yara,jshufelt/yara,frbapolkosnik/yara,wxsBSD/yara,VirusTotal/yara,hillu/yara,foreni-packages/yara,plusvic/yara,tanium/yara,tanium/yara,neatsun/yara,wxsBSD/yara,binsrc/yara,rednaga/yara,msuvajac/yara,jshufelt/yara,smaudet/yara,digideskio/yara,Security513/yara,wxsBSD/yara,plusvic/yara,cblichmann/yara,cblichmann/yara,plusvic/yara,msuvajac/yara,jpypi/yara,0x0mar/yara,kallanreed/yara,kallanreed/yara,Security513/yara,hillu/yara,binsrc/yara,jshufelt/yara,mgoffin/yara,digideskio/yara,Security513/yara,wxsBSD/yara,tdr130/yara,VirusTotal/yara,tdr130/yara,frbapolkosnik/yara,jshufelt/yara,pombredanne/yara,binsrc/yara,plusvic/yara,hillu/yara,0x0mar/yara,VirusTotal/yara,foreni-packages/yara,pombredanne/yara,VirusTotal/yara,bmagistro/yara,wxsBSD/yara,MeteorAdminz/yara,frbapolkosnik/yara,hillu/yara,tanium/yara,VirusTotal/yara,rednaga/yara,rayyang2000/yara,foreni-packages/yara,jpypi/yara,frbapolkosnik/yara,tdr130/yara,bmagistro/yara,beikezcs/yara,mgoffin/yara,beikezcs/yara,beikezcs/yara,digideskio/yara,mgoffin/yara,smaudet/yara,binsrc/yara,neatsun/yara,smaudet/yara,jpypi/yara,rayyang2000/yara,plusvic/yara,cblichmann/yara