Fileinfo produces wrong resources for a specific sample
- Dominant language
- C++
- Stars
- 8.6k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Description
Fileinfo produces wrong resources for sample `00003B88CF622D8213B956201BC5BEE5E1097F99EF6D7DEDECE36E42A191104F`. Our output:
```
0 500 FILE English 9 1 0x01271dc 0x006ab3d d4d64f9e
1 501 FILE English 9 1 0x0191d1c 0x4c4b7e4 67db8c03
2 502 FILE English 9 1 0x4ddd500 0x0028e78 dbbbc069
3 503 FILE English 9 1 0x4e06378 0x00031b8 de7a18a2
4 504 FILE English 9 1 0x4e09530 0x0056255 e3c8a573
5 505 FILE English 9 1 0x4e5f788 0x0015c66 58239925
6 512 FILE English 9 1 0x4e753f0 0x0005868 ce6e8c63
```
However offset and size does not match either `objdump`, LIEF nor PEView. Example of the output from `objdump`:
```
000 Type Table: Char: 0, Time: 00000000, Ver: 4/0, Num Names: 6, IDs: 8
010 Entry: name: [val: 800008b0 len 3]: DLL, Value: 0x80000080
080 Name Table: Char: 0, Time: 00000000, Ver: 4/0, Num Names: 0, IDs: 1
090 Entry: ID: 0x000202, Value: 0x80000298
298 Language Table: Char: 0, Time: 00000000, Ver: 4/0, Num Names: 0, IDs: 1
2a8 Entry: ID: 0x000409, Value: 0x000640
640 Leaf: Addr: 0x729b3c, Size: 0x21fb20, Codepage: 1252
018 Entry: name: [val: 800008b8 len 3]: GIF, Value: 0x80000098
098 Name Table: Char: 0, Time: 00000000, Ver: 4/0, Num Names: 1, IDs: 0
0a8 Entry: name: [val: 800008c0 len 8]: ACTIVITY, Value: 0x800002b0
2b0 Language Table: Char: 0, Time: 00000000, Ver: 4/0, Num Names: 0, IDs: 1
2c0 Entry: ID: 0x000409, Value: 0x000650
650 Leaf: Addr: 0x94965c, Size: 0x000136, Codepage: 1252
020 Entry: name: [val: 800008d2 len 8]: IDT_SZSR, Value: 0x800000b0
0b0 Name Table: Char: 0, Time: 00000000, Ver: 4/0, Num Names: 0, IDs: 1
0c0 Entry: ID: 0x000203, Value: 0x800002c8
2c8 Language Table: Char: 0, Time: 00000000, Ver: 4/0, Num Names: 0, IDs: 1
2d8 Entry: ID: 0x000409, Value: 0x000660
660 Leaf: Addr: 0x949794, Size: 0x19a555, Codepage: 1252
028 Entry: name: [val: 800008e4 len 3]: PNG, Value: 0x800000c8
0c8 Name Table: Char: 0, Time: 00000000, Ver: 4/0, Num Names: 13, IDs: 0
0d8 Entry: name: [val: 800008ec len 10]: ARROW-DOWN, Value: 0x800002e0
2e0 Language Table: Char: 0, Time: 00000000, Ver: 4/0, Num Names: 0, IDs: 1
2f0 Entry: ID: 0x000409, Value: 0x000670
670 Leaf: Addr: 0xae3cec, Size: 0x000075, Codepage: 1252
0e0 Entry: name: [val: 80000902 len 10]: ARROW-LEFT, Value: 0x800002f8
2f8 Language Table: Char: 0, Time: 00000000, Ver: 4/0, Num Names: 0, IDs: 1
308 Entry: ID: 0x000409, Value: 0x000680
680 Leaf: Addr: 0xae3d64, Size: 0x000070, Codepage: 1252
0e8 Entry: name: [val: 80000918 len 11]: ARROW-RIGHT, Value: 0x80000310
310 Language Table: Char: 0, Time: 00000000, Ver: 4/0, Num Names: 0, IDs: 1
320 Entry: ID: 0x000409, Value: 0x000690
...
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing fileinfo's output for sample 00003B88CF622D8213B956201BC5BEE5E1097F99EF6D7DEDECE36E42A191104F and compare its resource offsets and sizes with the objdump output in the issue. Investigate the resource entries shown for DLL, GIF, PNG, and related types. Done means fileinfo reports offsets and sizes consistent with the reference tools.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100