Windows and Windows-kernel platforms should include PE file format types.

Open
#4,147 3 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Stale
Tech stack
cpp
Domain
operating-systems, reverse-engineering

Research direction

Review the existing Binary Ninja structures that correspond to PE structures, then compare them with the requested Windows and Windows-kernel platform types. Add the listed IMAGE_* structures using their exact widely recognized names, and verify that the requested PE parsing types are available on both platforms.

Written by the indexing model from the issue text.

Description

Component: Platform File Format: PE Impact: Low

Currently I'm reversing a malware which does a lot of PE parsing. Looks like structures like IMAGE_DOS_HEADER, IMAGE_FILE_HEADER, IMAGE_DATA_DIRECTORY, IMAGE_OPTIONAL_HEADER32, IMAGE_OPTIONAL_HEADER64, IMAGE_NT_HEADERS64, IMAGE_NT_HEADERS32, IMAGE_SECTION_HEADER, IMAGE_EXPORT_DIRECTORY etc. missing in BN.

I know that BN have some structures that corresponds to some of these structures but these are (with these exact names) widely known structures that we need to have. Especially malwares heavly uses them.

Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Vector35/binaryninja-api

All issues in Vector35/binaryninja-api

Similar issues

More C++ issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.