Fileinfo is slow: overlays
- Dominant language
- C++
- Stars
- 8.6k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Description
File with this hash:
```
297B4023AB76CBE40A9E097DF26B6B573118E3C4F837271FB4E15D744DC4D607
```
takes too long to process by fileinfo. Its size is 840 MB, so it is not that surprising. However, according to this, its size without an overlay is only 300 KB:
```
Overlay offset : 0x4d400
Overlay size : 0x346d818e
```
So, is it necessary for fileinfo to work with an entire file the whole time? All the data should be needed only for computation of size of file and hashes. All the other things should need only PE without overlays. This would greatly reduce the time needed to analyze the file.
More files like this:
```
31D96A4AFD555ADD4A15707794C77B83B316E4C31639CB84077BA17C73492031
20B55892AB90F2E44607FD0C03D3DC680D3E27580827E56FCB6725728DA692BF
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by tracing the fileinfo entry point and the code that processes PE overlays, using the reported 840 MB sample and overlay offset/size as the reproduction case. Done means analysis no longer processes overlay data unnecessarily while file size and hash results remain correct; compare processing time before and after.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- cli, performance, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100