avast / avast/retdec

Fileinfo: parse .pdata section from PE(+) files

Open
#243 1 comment 0 reactions 0 assignees View on GitHub
C-fileinfo new-feature T-format-pe
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

It looks like PE(+) files may contain `.pdata` section with info on functions in the binary:
```
The Function Table (interpreted .pdata section contents)
vma: BeginAddress EndAddress UnwindData
000000014001d000: 0000000140001010 0000000140001043 000000014001937c
000000014001d00c: 0000000140001050 00000001400010be 0000000140019bbc
000000014001d018: 00000001400010c0 0000000140001113 0000000140018fd0
...
```
It is referenced by the exception table entry:
```
The Data Directory
...
Entry 3 000000000001d000 00000f90 Exception Directory [.pdata]
```

It would be useful to parse it.

Specification: https://msdn.microsoft.com/en-us/library/windows/desktop/ms680547(v=vs.85).aspx#the_.pdata_section

Example file: [ack.zip](https://github.com/avast-tl/retdec/files/1784785/ack.zip)

Also, search the PE specification for other similar structures that we are not currently handling.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the PE Fileinfo parser and the Exception Directory described in the linked Microsoft specification; inspect ack.zip as the example input. Done means .pdata function-table records are parsed for PE(+) files, with other similar unhandled PE structures considered as requested.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.