Vector35 / Vector35/binaryninja-api

Unify the PE header types created by the PE view and that from the Platform types

Aperta
#5,892 3 commenti 1 reazione 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Component: BinaryViewType Effort: Low File Format: PE Impact: Low
Lingua principale
C++
Stelle
1.3k
Fork
298
Merge medio
5g 5h
PR unite (30g)
19

Descrizione

A recurring situation during Windows malware analysis is that the code parse the PE for certain purposes. To deal with the code, often times we would like to apply appropriate types to the variables, e.g., setting the type of the variable that holds the PE header or the NT header. However, there are two cases where this workflow is not as smooth as we wish it to be:

  1. The user navigates to the start of the PE view and see what the type is and then apply it. In binja, we put a COFF header followed by a PE64_Optional_Header (or PE32_Optional_Header). We did this for good -- some object files may not have the PE64_Optional_Header. However, the problem is if the user sets the variable type to COFF_Header, then he would not be able to resolve offsets to the optional header, e.g., the export directory
    Screenshot 2024-08-29 at 1 52 47 PM

  2. The user is aware of the situation described in 1), and he knows there is a IMAGE_NT_HEADERS64 from the type library that we can use. Setting the variable to IMAGE_NT_HEADERS64 will produce better output, however, a few things can be improved, e.g., the IMAGE_NT_HEADERS64 has the data directory as IMAGE_DATA_DIRECTORY DataDirectory[0x10], which is NOT as descruptive as what we do in PE64_Optional_Header, which we define 16 separate members each with their name. Besides, various enums are just defined as WORD or DWORD, which is also not the best. See the below screenshot for an illustration on what I am talking about:

Screenshot 2024-08-29 at 1 57 33 PM

As such, I think a possible route is to combine the two types and have the PE view directly use the type from the type library instead of defining its own. Alternatively, if this is not viable, then maybe we can at least change the IMAGE_NT_HEADERS64 type in the type library to make it look closer to the COFF_Header+IMAGE_NT_HEADERS64, but have them sit in one larger structure, so that the code can resolve references to offsets into IMAGE_NT_HEADERS64 properly

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Direzione di ricerca

Start by locating the PE view definitions for COFF_Header and PE64_Optional_Header, then compare them with IMAGE_NT_HEADERS64 in the type library. Determine whether the types can be unified while preserving named data directories and useful enum types; done means PE views and applied platform types resolve the same header fields and offsets.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
cpp
Ambito
reverse-engineering
Tipo di issue
Funzionalità
Difficoltà
4/5
Tempo stimato
3-5 giorni
Stato di attività
Ferma
Chiarezza
Abbastanza chiara
Idoneità per principianti
35/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.