avast / avast/retdec

fileinfo: Detection of resource content type in PE files

Open
#414 0 comments 0 reactions 0 assignees View on GitHub
C-fileformat C-fileinfo new-feature T-format-pe
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

`fileinfo` is able to provide information about resources in the binary. As seen in this output

```
Resource table
--------------
Number of resources: 3

i nameId type typeId language lanId slanId offset size crc32
-----------------------------------------------------------------------------------------------------------
0 1 Icon 3 German 7 1 0x1488 0x8a8 eea791c8
1 101 Dialog box 5 German 7 1 0x10f0 0x396 fd927827
2 105 Icon Group 14 German 7 1 0x1d30 0x014 d0f61658
```

we already provide information like resource type, language, offset and size. However we do not say anything about the contents of the resource itself.

I propose that we also provide information about the type of the content of each resource. The detection could be signature-based but could also be heuristic-based. Each content type would have a category and optionally subcategory. Some proposed categories and their subcategories:

* `Text`
* `XML`
* ...
* `Image`
* `BMP`
* `PNG`
* `JPEG`
* ...
* `Binary`
* `PE`
* `PDF`
* ...
* ...

Another option is to use [MIME types](https://www.iana.org/assignments/media-types/media-types.xhtml) but then we could possibly be limited with what we can express.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by inspecting the existing fileinfo resource-table reporting and how resource contents are accessed. Define the supported content categories, subcategories, and signature or heuristic rules before implementation. Done means each reported resource can expose a content type without losing its existing metadata.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.