m4b / m4b/goblin

PE strings include NUL char

Open
#311 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
1.5k
Forks
202
PR merge metrics
No merged PRs in 30d

Description

i'm using goblin to get the required info from PE headers to construct path of pdb on symbol server. cv.filename retains the NUL terminator and was screwing stuff up. It might be annoying to implement correctly throughout the parser, as iirc some strings are exactly sized while others still keep terminating char (even tho they're sized), and probably others can be either way. It would be great if goblin presented them in a uniform way.

if let Some(cv) = debug.codeview_pdb70_debug_info {
    if cv.filename.len() > 0 && cv.filename[0] == 0 {
        // goblin keeps NUL in str :/
        return None;
    }
    if let Ok(pdb_path) =
        std::str::from_utf8(&cv.filename[..cv.filename.len() - 1])
    {
        if let Some(pdb_name) =
            Path::new(pdb_path).file_name().and_then(|x| x.to_str())
        {
            if let Ok(guid) = uuid::Uuid::from_slice_le(&cv.signature) {
                let specifier =
                    format!("{}{:X}", guid.simple().to_string(), cv.age);
                return Some(format!(
                    "{}/{}/{}",
                    pdb_name, specifier, pdb_name
                ));
            }
        }
    }
}

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the PE debug information entry point exposed as debug.codeview_pdb70_debug_info and inspect how cv.filename is parsed. Compare the handling of sized strings and NUL terminators across the PE parser. Done means callers receive consistently represented strings without needing to trim or remove a terminator themselves.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.