Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fileinfo: dump more info from WinPE format in verbose mode #137

Open
PeterMatula opened this issue Jan 31, 2018 · 1 comment
Open

Fileinfo: dump more info from WinPE format in verbose mode #137

PeterMatula opened this issue Jan 31, 2018 · 1 comment

Comments

@PeterMatula
Copy link
Collaborator

PeterMatula commented Jan 31, 2018

Lists of proposal to add to fileinfo.

Info like in PEStudio:

  • size of file in bytes
  • DOS header (magic, etc.)
  • file header (timestamp, pointer to symbol table, number of symbols, etc.)
  • optional header (linker, size of code, OS, checksum, subsystem etc.)
  • directories - check why our table names differ from PEStudio
  • sections - check/add cave size (number of bytes for alignment between 2 sections? misused for code patching?)
  • imports - libs and symbols
  • imported/exported symbols
  • exceptions
  • thread storage (fileinfo: Parsing of thread-local storage in PEs #417)
  • relocations - probably just how many there are
  • version - CompanyName, FileDescription, Language, InternalName, CopyRight (Parse and present VERSIONINFO (Version) resource in fileinfo #408)
  • SecurityCookie in load config directory, other info from this table?
  • etc.

Cuckoo like heuristics for language detections in version:

Stuff like in Python pefile.

@s3rvac
Copy link
Member

s3rvac commented Nov 14, 2018

As for timestamps, we should also support timestamps that are actually hashes originating from reproducible builds.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants