Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Handling of parsed PE Header for writer #1

Closed
GanbaruTobi opened this issue Mar 10, 2024 · 2 comments
Closed

Handling of parsed PE Header for writer #1

GanbaruTobi opened this issue Mar 10, 2024 · 2 comments

Comments

@GanbaruTobi
Copy link

I tried to write a parsed PE to file.

let mut pe_mem = goblin::pe::PE::parse_with_opts(memory_data, &poptions)?; 
for section in &mut pe_mem.sections {
        section.pointer_to_raw_data = section.virtual_address;
        section.size_of_raw_data = section.virtual_size;
}
let mut pe_writer = PEWriter::new(pe_mem).expect("Failed to create a wrapper");
let new_pe = pe_writer.write_into().unwrap();
std::fs::write(name.to_string(), &new_pe[..]).unwrap();

The writer modifies the PE without my interaction. Sadly only my set virtual_address is accepted. The size is being reset to the original values.

The following screenshot shows the .reloc section three times.

  1. original section
  2. then modified with the code above
  3. the result if I read the file that pe_writer wrote back in:
    grafik

I see two options here, either the pe_writer respects the &pe_mem reference and doesn't modify it on its own or ifrit should clearly state that all modifications have to happen trough the pe_writer and make all pe fields accessible.

@RaitoBezarius
Copy link
Owner

Maybe it's not clear enough from docs / etc. (open to suggestions on that)

But the library is not made for you changing arbitrary elements and expecting the layoutting to work out of the box.
It's made to recompute the offsets that cannot be predicted, e.g. the pointer on disk.

If you want to write a structure as-is, serialize it, this is not this library's concern per se, but just normal Goblin usage.

@GanbaruTobi
Copy link
Author

Oh, okey, i was brought here from goblin ( m4b/goblin#394) so might have been an confusion.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants