fileinfo detects both UPX and MPRESS for the same PE binary file
- Dominant language
- C++
- Stars
- 8.6k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Description
`fileinfo` detects both UPX and MPRESS for the same PE binary file.
## Input
Run
```
$ retdec-fileinfo FILE
```
where `FILE` is:
* [`27AA4828D922898A79BA22A297C275132A562CFCD4A2CA37D9E3A567E9C4D4E5`](https://www.virustotal.com/#/file/27aa4828d922898a79ba22a297c275132a562cfcd4a2ca37d9e3a567e9c4d4e5/details)
## Output
```
...
Detected tool: Microsoft Linker (7.1) (linker), combined heuristic
Detected tool: UPX (packer), section table heuristic
Detected tool: MPRESS (2.12 - 2.19 [LZMA]) (packer), 84 from 84 significant nibbles (100%)
Detected tool: MPRESS (1.x - 2.x) (packer), 76 from 76 significant nibbles (100%)
...
```
## Expected output
I suggest checking why we detect both UPX and MPRESS for the above file. Are both of these detections really correct? When I try to unpack the file via `retdec-unpacker`, I get the following output:
```
$ retdec-unpacker 27AA4828D922898A79BA22A297C275132A562CFCD4A2CA37D9E3A567E9C4D4E5
No matching plugins found for 'Microsoft Linker 7.1'
[ERROR] [UPX] Unsupported unpacking stub detected.
[MPRESS] Successfully unpacked '27AA4828D922898A79BA22A297C275132A562CFCD4A2CA37D9E3A567E9C4D4E5'!
```
## Configuration
* Commit: 76c24b8a054ec9bd98867087ea00e395f8e3a872 (current `master`)
* 64b Arch Linux, GCC 7.3.1, Debug build of RetDec
Contributor guide
No contributing guide indexed for this repository
Research direction
Reproduce the report with retdec-fileinfo on the supplied SHA-256 sample, then compare its UPX and MPRESS detections with retdec-unpacker, which successfully uses MPRESS and rejects UPX. Trace the detection heuristics and unpacker entry points to determine whether both signatures can be valid; done means the reported tool identification is accurate and the conflicting result is resolved or clearly explained.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100