Fileinfo: dump more info from WinPE format in verbose mode
- Dominant language
- C++
- Stars
- 8.6k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Description
Lists of proposal to add to `fileinfo`.
Info like in [PEStudio](https://www.winitor.com/):
- size of file in bytes
- DOS header (magic, etc.)
- file header (timestamp, pointer to symbol table, number of symbols, etc.)
- optional header (linker, size of code, OS, checksum, subsystem etc.)
- directories - check why our table names differ from PEStudio
- sections - check/add cave size (number of bytes for alignment between 2 sections? misused for code patching?)
- imports - libs and symbols
- imported/exported symbols
- exceptions
- thread storage (#417)
- relocations - probably just how many there are
- version - `CompanyName, FileDescription, Language, InternalName, CopyRight` (#408)
- `SecurityCookie` in [load config directory](https://msdn.microsoft.com/en-us/library/windows/desktop/ms680328(v=vs.85).aspx), other info from this table?
- etc.
Cuckoo like heuristics for language detections in `version`:
- https://github.com/brad-accuvant/community-modified/blob/master/modules/signatures/origin_langid.py
Stuff like in Python [pefile](https://github.com/erocarrera/pefile).
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reviewing the current `fileinfo` verbose output and comparing it with the PEStudio and Python `pefile` references linked in the issue. The proposal spans headers, directories, sections, imports, symbols, exceptions, version data, and heuristics, so a contributor would need to narrow the scope before implementation; done should mean the selected WinPE details are reported and covered by appropriate existing tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100