Fileinfo: parse .pdata section from PE(+) files
- Dominant language
- C++
- Stars
- 8.6k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Description
It looks like PE(+) files may contain `.pdata` section with info on functions in the binary:
```
The Function Table (interpreted .pdata section contents)
vma: BeginAddress EndAddress UnwindData
000000014001d000: 0000000140001010 0000000140001043 000000014001937c
000000014001d00c: 0000000140001050 00000001400010be 0000000140019bbc
000000014001d018: 00000001400010c0 0000000140001113 0000000140018fd0
...
```
It is referenced by the exception table entry:
```
The Data Directory
...
Entry 3 000000000001d000 00000f90 Exception Directory [.pdata]
```
It would be useful to parse it.
Specification: https://msdn.microsoft.com/en-us/library/windows/desktop/ms680547(v=vs.85).aspx#the_.pdata_section
Example file: [ack.zip](https://github.com/avast-tl/retdec/files/1784785/ack.zip)
Also, search the PE specification for other similar structures that we are not currently handling.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the PE Fileinfo parser and the Exception Directory described in the linked Microsoft specification; inspect ack.zip as the example input. Done means .pdata function-table records are parsed for PE(+) files, with other similar unhandled PE structures considered as requested.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 32/100