fileinfo: Detection of resource content type in PE files
- Dominant language
- C++
- Stars
- 8.6k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Description
`fileinfo` is able to provide information about resources in the binary. As seen in this output
```
Resource table
--------------
Number of resources: 3
i nameId type typeId language lanId slanId offset size crc32
-----------------------------------------------------------------------------------------------------------
0 1 Icon 3 German 7 1 0x1488 0x8a8 eea791c8
1 101 Dialog box 5 German 7 1 0x10f0 0x396 fd927827
2 105 Icon Group 14 German 7 1 0x1d30 0x014 d0f61658
```
we already provide information like resource type, language, offset and size. However we do not say anything about the contents of the resource itself.
I propose that we also provide information about the type of the content of each resource. The detection could be signature-based but could also be heuristic-based. Each content type would have a category and optionally subcategory. Some proposed categories and their subcategories:
* `Text`
* `XML`
* ...
* `Image`
* `BMP`
* `PNG`
* `JPEG`
* ...
* `Binary`
* `PE`
* `PDF`
* ...
* ...
Another option is to use [MIME types](https://www.iana.org/assignments/media-types/media-types.xhtml) but then we could possibly be limited with what we can express.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by inspecting the existing fileinfo resource-table reporting and how resource contents are accessed. Define the supported content categories, subcategories, and signature or heuristic rules before implementation. Done means each reported resource can expose a content type without losing its existing metadata.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100