avast / avast/retdec

fileinfo generates several identical .NET TypeRef entries without a library

Open
#432 0 comments 0 reactions 0 assignees View on GitHub
C-fileinfo T-format-pe T-lang-dotnet
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

`fileinfo` generates several identical .NET TypeRef entries without a library.

## Input

Run
```
$ retdec-fileinfo -v FILE
```
where `FILE` is
* [`0BB3B1FB7265612BC5AD81A91E570EB308F0D0FC4E2AB06C526DBEEEF65905A6`](https://www.virustotal.com/#/file/0bb3b1fb7265612bc5ad81a91e570eb308f0d0fc4e2ab06c526dbeeef65905a6/detection)
* `0C20C5ED27822D4E8EA4B1C59C4E3B87EBA6E3580CAE1DC4B0DEDDD9D89DA4A1`
* `0E0D2FC23BCD20A22899B1099D195560427E06670574AFBBE442B0A84DA545CA`
* `0E30368A894EB52B0897EB7C97DFFC47F9701D29765A88B3C3F7D6866DEF9006`
* `2359C8C3A44EC35287EC825F4FBA5E334D73800D2ECB2544FF960A530C606533`
* `257A6115A715E72F04E64ED014D9D6D37E5C6D89D96524C8252A4858A213F02B`
* `294BEB4CF469DFA0D4A7693CCD593B5D411EE90D9B286698CF2D714A41FEACEF`
* `2D71CA1E85AB91DB99CCCE826D1E115F3B21E49DBC3E86A1B4AEF4A6CB23817B`
* `3499B35D9EF3ECA679250A5C67A4103E68D03B40CE8A40339504756B535C6ADD`
* `392962E2C486CDF975D8EE916593C38A2BD71C456C99CFA1BBFE20F664D26DCB`

## Output

```
TypeRef table
-------------
[..]

i name nameSpace
--------------------------------------------------------------------------------------
0 System.Reflection le>
1 System.Reflection le>
2 System.Reflection le>
3 System.Reflection le>
4 System.Reflection le>
```

## Expected output

Please, verify:
1. Why there is no `libName`?
2. What is the `le>` namespace?
3. Why there are five identical entries in the TypeRef table?

The output may be correct. I would just like a verification that it is indeed correct.

## Configuration

* Commit: 9e84d30d9cbcec074f3671556fb23d43ec809c97 (current `master`)
* 64b Debian Stretch, GCC 8, Release build of RetDec

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by running retdec-fileinfo -v on the listed FILE samples and inspect the TypeRef table output. Trace how fileinfo derives libName, namespace, and duplicate TypeRef entries; done means documenting whether the output is correct and explaining each of the three reported questions, since no source file or test is named.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.