fileformat: Detection of strings in .NET files
- Dominant language
- C++
- Stars
- 8.6k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Description
Our detection of strings ignores sections and segments for which we are sure there is only code.This approach does not work for .NET files which usually contains `.text` section (and additionally `.rsrc`) in which basically everything related to the .NET IL is placed and this information contain many valuable strings. We already have detection of .NET so we should somehow incorporate this as exception into string detector. Since string detector is implemented in `FileFormat` and .NET detection is in `PeFormat`, we need to somehow propagate the information from `PeFormat` to `FileFormat`, for example with `virtual` method which would accept section/segment as argument and would return `true`/`false` -- this section/segment does/doesn't contain strings.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reading the string detector in FileFormat and the .NET detection in PeFormat, focusing on how sections and segments are classified. Trace how the .text and .rsrc sections of .NET files are currently excluded, then define and test the propagation needed so their valuable strings are detected without changing behavior for other formats.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100