Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fileinfo: Corruption check needs to distinguish between "file is cut" and "file is cut, but executable" #463

Closed
ladislav-zezula opened this issue Jan 14, 2019 · 1 comment
Closed

fileinfo: Corruption check needs to distinguish between "file is cut" and "file is cut, but executable" #463

ladislav-zezula opened this issue Jan 14, 2019 · 1 comment
Assignees
@ladislav-zezula
Labels
C-fileinfo enhancement T-format-pe

Comments

@ladislav-zezula
Copy link
Contributor

ladislav-zezula commented Jan 14, 2019 •
edited
Loading

Under some circumstances, a cut PE file might be still executable.

Examples:
82b82208e35402e11a68766f057cfdcabf5cd97c73ee5eeaa008548095597865 (32-bit)
8713f9a10a9e859b245031474acf770d719aab1f8cea1d957af41dea08019bc6 (64-bit)

Both these files were cut but are still loadable and executable, because the last PE section has physical size of 0.

We need a new class for file corruption: LDR_ERROR_FILE_IS_CUT_LOADABLE
This was referenced Jan 16, 2019
Merged
Merged
s3rvac added a commit that referenced this issue Jan 17, 2019
@s3rvac
Update the used version of pelib.
5badadb 
To its current master, which contains an implementation of #463.
@s3rvac
Copy link
Member

s3rvac commented Jan 17, 2019

Implemented by @ladislav-zezula in avast/pelib#5 (tests are in avast/retdec-regression-tests#16). Incorporated into RetDec in 5badadb.

@s3rvac s3rvac closed this as completed Jan 17, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@ladislav-zezula ladislav-zezula

Labels
C-fileinfo enhancement T-format-pe
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@ladislav-zezula @s3rvac