Fileinfo: incorrect class names from .NET binaries
- Dominant language
- C++
- Stars
- 8.6k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Description
Analysis of [this](https://www.virustotal.com/en/file/50874EA421F69DDF3F16005C151DA0CA862379752DC7DA1ABA9D45A0EF38EDF1/analysis/) .NET binary produces probably incorrect class names.
**Execution:**
```
retdec-fileinfo -v 50874EA421F69DDF3F16005C151DA0CA862379752DC7DA1ABA9D45A0EF38EDF1
```
**Output:**
```
private class @W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xf[..]
public class o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09[..]
public class o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09[..]
public abstract class o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\[..]
public abstract class o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\[..]
public class o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09[..]
public class o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09[..]
public class \x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W[..]
public class o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09[..]
public sealed class o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xf[..]
public abstract sealed class o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@[..]
public sealed class \x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09o\xfd@W\x09[..]
[..]
```
**Expected output**
It looks like garbage is being processed somewhere - do not process it.
**More sample hashes to tests:**
```
022BB40C6EF5934E6CEAFB55CF87BD016D879DFC4DAF51B3204F1DB5192E5334
155852B93A6D9805D3904F8D994AEA4127C625F57D479D12AEEC45E0AAB7DD6C
229BD6EA377FDF63AE48117003FDD9586EF6F8AA93BC012A29F9A60950ACB8C1
2FF26FF2359F06FF813D60E38641B9A610554F38B6934C2CE5A95E1B602C429E
50874EA421F69DDF3F16005C151DA0CA862379752DC7DA1ABA9D45A0EF38EDF1
5FF4F808C820954D8276175C971458F0701B9D56A95D1F1C7DFE3C155B48E083
6307EB259B8F2BCD5C28F12767A75FF71D5C080124517BA76B15A0D68755BF0C
6B6E14558AC98A1739A40B3AE0E57CB49C7EEED9521151E438643B9AA98BCA18
716943A8953839E3C2D599BA0623AF7E44380678480F23CC45608CF89FABF386
74C1A65FE0F588A0F5509F82A089730CC6A4DE609CE834525D02DA6EF5CA29DB
7F1D88DBDB8158FCB227FC756D13490648197288E7C77E35412B876AC9F7805B
A715DF021FFE8DF8B5B2FA12A684D2F8767E33A7478AD582476FF6230A4993A5
B4186462710F88EFEFC7A6B11D8CA1FCB3111B3EE0AB4C9BB3303E74BDF73E9F
C636827E5D772B360F564DEFD08A043B8A48BFBBC5C5D3750F1E7CB04022CE51
D0A9A57F475C3282CC89D1DCB9033285F7709CFFC0CDFD1E847906BFA63F0034
D87923305C8E1EA308B83FA01F54EE2BAADC095EECA1B26E8DEE865D24EB8A12
DACE902E68ACE2C29D32057A654BC80448C10664066675D276DC091818500DC8
E3C42E50512163AA3A9DED9AB41869B5480164EB95C6B92A7FDD1DFD9A72204D
E7E6A241A5282D5FF90640A85615F719FC5A28C60C26E0463AE118DFC2E21D87
F47AA800541E852C89FBC1D1DA3268F4137244FFF0F0BB8243E009B9D4CBFBE0
FFF86F7370E4C7800FCA297C2A60093FEF810FA6F1F4C8F727E1DDE07CA765F7
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by running retdec-fileinfo -v with the reported sample hash and compare its class-name output with the expected behavior. Reproduce the issue across the additional hashes listed in the report, then identify where the garbage names enter analysis; done means malformed data is no longer emitted as class names for these .NET binaries.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100