avast / avast/retdec

Review code that checks packers based on section names

Open
#524 0 comments 0 reactions 0 assignees View on GitHub
C-cpdetect enhancement
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

In Adam's blog (http://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/), there is an updated list of section names. You may want to review code in https://github.com/avast-tl/retdec/blob/master/src/cpdetect/compiler_detector/heuristics/pe_heuristics.cpp and add new ones, if necessary.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with src/cpdetect/compiler_detector/heuristics/pe_heuristics.cpp and compare its existing section-name checks with the updated list in Adam's blog post. Review which names are missing and determine whether adding them is warranted; done means the relevant checks reflect the reviewed list and packer detection behavior is preserved.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.