fileinfo: Detection of overlay content type
- Dominant language
- C++
- Stars
- 8.6k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Description
Overlay data appended to executable files are not part of the executable image but they are often used to store configuration/another MZ(PE) files/payloads/etc. We should detect the content type of overlay in the same way as in #414. This information can be valuable for analysts and other tools where `fileinfo` is part of the toolchain.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reading issue #414 and locating the existing fileinfo content-type detection it describes. Trace how executable overlay data is identified and reported, then verify that appended overlay content receives a type without changing the executable image result; the issue provides no file or test path.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100