avast / avast/retdec

Fileinfo: dump more info from WinPE format in verbose mode

Open
#137 1 comment 0 reactions 0 assignees View on GitHub
C-fileinfo enhancement
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

Lists of proposal to add to `fileinfo`.

Info like in [PEStudio](https://www.winitor.com/):
- size of file in bytes
- DOS header (magic, etc.)
- file header (timestamp, pointer to symbol table, number of symbols, etc.)
- optional header (linker, size of code, OS, checksum, subsystem etc.)
- directories - check why our table names differ from PEStudio
- sections - check/add cave size (number of bytes for alignment between 2 sections? misused for code patching?)
- imports - libs and symbols
- imported/exported symbols
- exceptions
- thread storage (#417)
- relocations - probably just how many there are
- version - `CompanyName, FileDescription, Language, InternalName, CopyRight` (#408)
- `SecurityCookie` in [load config directory](https://msdn.microsoft.com/en-us/library/windows/desktop/ms680328(v=vs.85).aspx), other info from this table?
- etc.

Cuckoo like heuristics for language detections in `version`:
- https://github.com/brad-accuvant/community-modified/blob/master/modules/signatures/origin_langid.py

Stuff like in Python [pefile](https://github.com/erocarrera/pefile).

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reviewing the current `fileinfo` verbose output and comparing it with the PEStudio and Python `pefile` references linked in the issue. The proposal spans headers, directories, sections, imports, symbols, exceptions, version data, and heuristics, so a contributor would need to narrow the scope before implementation; done should mean the selected WinPE details are reported and covered by appropriate existing tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.