Fix issues in version info parsing in pe module #155
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Fix several issues related to version info parsing: - the key name of the string table was assumed to be "040904B0" which is not always the case. - the alignment handling was not properly applied for rare files: the current offset should not be considered, only the relative length values of version infos. - the parsing of key then value was simplified to remove weird parsing from the end of the entry. Alignment is needed between the key and the value for proper parsing. - Properly handle multiple resource directories containing version infos.
Use the same limits as YARA for the strings used in version infos.
vthib
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fix several issues related to version info parsing:
is not always the case.
current offset should not be considered, only the relative length
values of version infos.
from the end of the entry. Alignment is needed between the key and the
value for proper parsing.
infos.
Also bound the size of the strings as is done in YARA