QuasarApp/LIEF
4
0
Fork 0
mirror of https://github.com/QuasarApp/LIEF.git synced 2025-04-26 20:34:32 +00:00
Code Issues Projects Releases Wiki Activity

Remove padding entry from the rich header

Browse Source
This commit is contained in:
Romain Thomas 2021-01-17 18:52:51 +01:00
parent 6e703014f6
commit 27547aec33
2 changed files with 7 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
doc/sphinx/changelog.rst
View File

@ -34,7 +34,7 @@ Changelog
.. seealso::
:class:`lief.PE.IMPHASH_MODE` and :func:`lief.PE.get_imphash`
* Remove the padding entry (0) from the rich header
* :attr:`~lief.PE.LangCodeItem.items` now returns a dictionary whose values are **bytes** (instead of
``str`` object). This change is related to ``utf-16`` support.
* :github_user:`kohnakagawa` fixed wrong enums values: :commit:`c03125045e32a9cd65c613585eb4d0385350c6d2`, :commit:`6ee808a1e4611d09c6cf0aea82a612be69584db9`, :commit:`cd05f34bae681fc8af4b5e7cc28eaef816802b6f`

13
src/PE/Parser.cpp
View File

@ -130,18 +130,14 @@ void Parser::parse_rich_header(void) {
LIEF_DEBUG("Parsing rich header");
const std::vector<uint8_t>& dos_stub = this->binary_->dos_stub();
VectorStream stream{dos_stub};
auto&& it_rich = std::search(
std::begin(dos_stub),
std::end(dos_stub),
std::begin(Rich_Magic),
std::end(Rich_Magic));
auto it_rich = std::search(std::begin(dos_stub), std::end(dos_stub),
std::begin(Rich_Magic), std::end(Rich_Magic));
if (it_rich == std::end(dos_stub)) {
LIEF_DEBUG("Rich header not found!");
return;
}
const uint64_t end_offset_rich_header = std::distance(std::begin(dos_stub), it_rich);
LIEF_DEBUG("Offset to rich header: 0x{:x}", end_offset_rich_header);
@ -153,7 +149,6 @@ void Parser::parse_rich_header(void) {
this->binary_->rich_header().key(xor_key);
LIEF_DEBUG("XOR key: 0x{:x}", xor_key);
uint64_t curent_offset = end_offset_rich_header - sizeof(Rich_Magic);
std::vector<uint32_t> values;
@ -177,6 +172,10 @@ void Parser::parse_rich_header(void) {
value = stream.peek<uint32_t>(curent_offset) ^ xor_key;
curent_offset -= sizeof(uint32_t);
if (value == 0 and count == 0) { // Skip padding entry
continue;
}
if (value == DanS_Magic_number or count == DanS_Magic_number) {
break;
}