Investigate discrepancies in PE resource detection compared to YARA

[metthal]

Sometimes we provide different PE resources than YARA. I haven't dig into this much deeper and don't know the cause but it should be investigated and fixed afterwards.

Files:

88ff9ef1f056be47f0da0d226e1295ba7a9668595dd5af5da3fcce89eafc204d
8a8154c36977c3f47a65c329a6dd93c58b8aff6050a4a748f4c610310daf0d8b

[HoundThe]

The first file seems to be ignored by YARA because the resource entries contain non-null characteristics. (thanks to @ ladislav-zezula)
After a deeper look, for the second file, YARA returns YR_UNDEFINED as offset value at certain entries, it seems like a sanity check for the offset validity within the file.

[HoundThe]

I've created PR that addresses the second sample with invalid offsets. Based on discussion with @ ladislav-zezula the first sample being different in YARA is wrong on the YARA side and not FileInfo.

[PeterMatula]

Second case fixed in #982.
As the first case doesn't seem to be a RetDec problem I'm closing this for now.

@metthal please have a look and do one of these:

1. If you don't agree, and think this should be addressed in RetDec please reopen this.
2. If you think this should be addressed in YARA, either create an issue there or let me know, I will do it.
3. Ignore.