Vector35 / Vector35/binaryninja-api

Unify the PE header types created by the PE view and that from the Platform types

Open
#5,892 3 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Component: BinaryViewType Effort: Low File Format: PE Impact: Low
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

A recurring situation during Windows malware analysis is that the code parse the PE for certain purposes. To deal with the code, often times we would like to apply appropriate types to the variables, e.g., setting the type of the variable that holds the PE header or the NT header. However, there are two cases where this workflow is not as smooth as we wish it to be:

  1. The user navigates to the start of the PE view and see what the type is and then apply it. In binja, we put a COFF header followed by a PE64_Optional_Header (or PE32_Optional_Header). We did this for good -- some object files may not have the PE64_Optional_Header. However, the problem is if the user sets the variable type to COFF_Header, then he would not be able to resolve offsets to the optional header, e.g., the export directory
    Screenshot 2024-08-29 at 1 52 47 PM

  2. The user is aware of the situation described in 1), and he knows there is a IMAGE_NT_HEADERS64 from the type library that we can use. Setting the variable to IMAGE_NT_HEADERS64 will produce better output, however, a few things can be improved, e.g., the IMAGE_NT_HEADERS64 has the data directory as IMAGE_DATA_DIRECTORY DataDirectory[0x10], which is NOT as descruptive as what we do in PE64_Optional_Header, which we define 16 separate members each with their name. Besides, various enums are just defined as WORD or DWORD, which is also not the best. See the below screenshot for an illustration on what I am talking about:

Screenshot 2024-08-29 at 1 57 33 PM

As such, I think a possible route is to combine the two types and have the PE view directly use the type from the type library instead of defining its own. Alternatively, if this is not viable, then maybe we can at least change the IMAGE_NT_HEADERS64 type in the type library to make it look closer to the COFF_Header+IMAGE_NT_HEADERS64, but have them sit in one larger structure, so that the code can resolve references to offsets into IMAGE_NT_HEADERS64 properly

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the PE view definitions for COFF_Header and PE64_Optional_Header, then compare them with IMAGE_NT_HEADERS64 in the type library. Determine whether the types can be unified while preserving named data directories and useful enum types; done means PE views and applied platform types resolve the same header fields and offsets.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.