mandiant / mandiant/capa

packed with Themida: section name

Open
#1,104 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug viv-bug
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

2826b762b9c268601a44974ef469a671b441e798a6c3cbb40070450c6c030ba2.exe_

new vivisect gives
```
file: 0x400000: section(PE_Header)
file: 0x401000: section( ^@ ) <----
file: 0x467000: section(.rsrc)
file: 0x46C000: section(.idata )
file: 0x46D000: section( )
file: 0x662000: section(vjxuqrij)
```

![2022-07-11_16-56-15](https://user-images.githubusercontent.com/17606537/178293962-f2565cd3-1aeb-4228-bbf9-24af48dbdd8f.png)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue names no source file, test, or entry point. Start by reproducing the reported output with the attached Themida-packed executable and trace how PE section names are obtained; done means the section-name behavior is handled as intended and covered by an appropriate regression test.

Written by the indexing model from the issue text.

Assessment

Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.