embedded pe: offsets are virtual addresses rather than file offsets
Open
Nobody has claimed this yet.
binary-ninja
bug
ghidra
ida
- Dominant language
- Python
- Stars
- 6.2k
- Forks
- 726
- Avg merge
- 11d 11h
- Merged PRs (30d)
- 7
Description
`characteristic: embedded pe` is a file-scoped feature, and therefore i think its intended that the associated address is a file offset.
pefile and viv backends extract file offsets correctly.
but IDA, Ghidra, and BN currently extract virtual addresses (and possibly mis-label them as file offsets.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect the IDA, Ghidra, and BN backends where embedded PE addresses are extracted, then compare their behavior with the pefile and viv backends. Verify whether each backend reports file offsets rather than virtual addresses, and confirm the resulting characteristic data is labeled consistently.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100