248 Commits

Author SHA1 Message Date
Eric Kilmer
6af9a82335
Fix memory leaks during cleanup of malformed PE (#146)
Replace copied cleanup deletes with `DestructParsedPE` function
2021-03-12 15:37:36 -05:00
Eric Kilmer
e5ba0165ab
Add simple test and corkami test suite using Catch2 (#145)
* Add simple test and corkami test suite using Catch2

* Enable testing with CMake option '-DPEPARSE_ENABLE_TESTING=ON'.

* The simple test is extremely basic just as an example of using Catch2.

* Corkami test suite is a git submodule within assets and the tests can
be run with or without cloning it. You are able to configure CMake
without the submodule and it will warn you that the tests are not
included, and then it will pick them up automatically on next cmake
rebuild.

There are a few Corkami files which pe-parse is unable to process. They
have been added as exceptions for now (just to get this merged), but we
can open new issues to track them. This will also catch any regressions
that could prevent the successful parsing of files that have been
parse-able in the past.

* Raise C++ standard from 11 to 17 for easier filesystem handling in
tests. Also included CMake script for handling how std::filesystem is
found/linked.

* Rename directory 'test' to 'tests'.

* Update README with testing instructions.

* Catch2 is downloaded and built unless otherwise specified
(undocumented, aside from reading CMake).
2021-03-10 14:01:34 -05:00
Eric Kilmer
d38c7daa7e
Use 'offsetof' to resolve undefined behavior (#142)
* Use 'offsetof' to resolve undefined behavior

../pe-parser-library/src/parse.cpp:1821:7: runtime error: member access
within null pointer of type 'typeof (curEnt)' (aka
'peparse::import_dir_entry')

* Fix bad rename
2020-11-26 12:49:19 -05:00
Eric Kilmer
68297aff83
Fix rotate-left function and caller with large shift number (#143)
* Fix rotate-left function and caller with large shift number

* Disable MSVC compiler unary minus operator warning
2020-11-26 12:48:43 -05:00
William Woodruff
76e3d41c4c
pepy: Remove old Python 2 cruft (#140) 2020-09-28 15:36:00 -04:00
William Woodruff
eb7d72a96f
README, examples: Fix lingering names 2020-09-25 15:51:25 -04:00
passthecilantro
327a524de1
Fix #1115 (#139)
Co-authored-by: William Woodruff <william.woodruff@trailofbits.com>
Co-authored-by: William Woodruff <william@trailofbits.com>
2020-09-25 15:48:28 -04:00
passthecilantro
a54ea62286
Rename libpe-parser-library -> libpe-parse (#138)
Co-authored-by: William Woodruff <william@yossarian.net>
2020-09-23 23:20:49 -04:00
passthecilantro
035679c10b
Disable library warnings by default (#137)
Fixes #106.
2020-09-22 21:01:15 -04:00
Nickie S
3996892523
Add ability to parse PE file without backing file (#136)
* Add ability to parse PE file without backing file

* Add size check

* Fix formatting

* Change buffer size type
2020-08-06 12:23:32 -04:00
William Woodruff
2ccec7608b
README: Add a note about vcpkg 2020-04-27 12:24:57 -04:00
William Woodruff
7177d60ba2
VERSION: 1.2.0 2020-04-24 13:49:35 -04:00
William Woodruff
79a2333a8b
treewide: CI, cmake fixes (#132)
Massages the pe-parse build into a format that's more accomodating
for vcpkg, in preparation for imminent packaging.
2020-04-24 13:48:46 -04:00
William Woodruff
572ff2f2f4
VERSION: 1.1.0 2020-04-20 15:09:29 -04:00
William Woodruff
4880b14a13
CI: Automatic pepy releases to PyPI (#131)
* workflows/release: Add PyPI release config

* util/release: Don't push to PyPI manually

The CI will handle this for us from now on.

* VERSION: 1.1.0.rc.1

* workflows/release: Try on this branch

* workflows/release: Syntax

* workflows/release: Disable on this branch

* VERSION: 1.1.0.rc.2
2020-04-20 14:57:01 -04:00
William Woodruff
8736072cc1
pe-parser-library: Use WinAPI for UTF-16 to UTF-8 (#130)
* pe-parser-library: Use WinAPI for UTF-16 to UTF-8

If ICU isn't available and we're on C++17 or later, use
the Windows API for Unicode conversion instead of codecvt.
2020-04-14 10:20:16 -04:00
William Woodruff
8adf31ac97
parse: Sort section list by file offset (#129)
Closes #128.
2020-04-08 22:58:30 -04:00
Eric Kilmer
566e4f6f8b
Pass resource by const pointer instead of value (#127)
* Pass resource by const pointer instead of value

Found/Suggested by LGTM:

This parameter of type resource is 128 bytes - consider passing a const
pointer/reference instead.

* Fix pepy

* resource by reference

* Change other iter* functions to be consistent pass by const reference
2020-04-06 10:48:33 -04:00
Eric Kilmer
3b7175276e
Add LGTM badge to README (#126) 2020-04-06 09:58:13 -04:00
William Woodruff
164666cb5b
parse: Fix small memory leak (#124) 2020-04-04 23:36:28 -04:00
William Woodruff
2bf8ad917e
parse: Fix DIR_SECURITY data directory retrieval (#122)
* parse: Fix DIR_SECURITY data directory retrieval

Fixes #121.

* parse: Fix variables

* parse: Add MSDN link for DIR_SECURITY special case
2020-03-30 10:04:57 -04:00
William Woodruff
c0208d643f
CMakeLists: Fix message() (#119) 2020-03-27 17:33:33 -04:00
William Woodruff
84d990dd53
nt-headers: Add IMAGE_DLLCHARACTERISTICS constants (#118)
* nt-headers: Add IMAGE_DLLCHARACTERISTICS constants

Like the other Win32 constants, these are guarded by
_PEPARSE_WINDOWS_CONFLICTS.

* nt-headers: Add comment
2020-03-27 14:48:51 -04:00
William Woodruff
14849a5e66
CMake: Set minimum to 3.12 (#117) 2020-03-27 11:50:36 -04:00
William Woodruff
a27dca9321
CMake: Set minimum to 3.11 (#116)
This was incorrectly set to 3.7, despite
add_compile_definitions appearing in 3.11.
2020-03-27 11:42:49 -04:00
William Woodruff
05676c1bf8
VERSION: 1.0.2 2020-03-26 10:12:34 -04:00
Eric Kilmer
50ff34288a
Fix finding version file (#114) 2020-03-26 10:11:13 -04:00
William Woodruff
9d4000c520
VERSION: 1.0.1 2020-03-18 11:48:58 -04:00
William Woodruff
d57f02a187
setup: Add homepage URL 2020-03-18 11:48:45 -04:00
William Woodruff
322bd6ad14
VERSION: 1.0.0
Closes #105.
Closes #112.
2020-03-17 13:39:30 -04:00
William Woodruff
1dc2c53566
Release 1.0 prep work (#113)
Co-authored-by: Eric Kilmer <eric.d.kilmer@gmail.com>
2020-03-17 13:38:56 -04:00
William Woodruff
c5e9a09087
Dockerfile, cmake: Simplify build (#111)
* Dockerfile, cmake: Simplify build

Always use clang in the Dockerfile, and don't overspecify
the build type.

Additionally, drop -Weverything when building in Debug mode --
it has competing flags internally and isn't intended for actual
builds.

* Dockerfile: Set CC and CXX

Ensures that we build with clang(++).

* python/setup: Blacken
2020-03-09 15:18:54 -04:00
William Woodruff
4b2aa738cb
parse: Handle a potential nullptr from splitBuffer (#110)
Identified by #109: when parsing the PE sections, we incorrectly
trust that the offset range given to us by each section is valid.

We pass this range to splitBuffer expectly a valid bounded_buffer.

splitBuffer correctly determines that the range is invalid, and
returns a nullptr to indicate failure.

We fail to check for that nullptr in getSections, resulting in
an eventual segfault by null dereference when we attempt to
reference the invalid section.

This commit adds a check for that nullptr and causes getSections
to return false. This is then propagated as an invalid
section error.

Example:

```bash
/app/pe-parse # /usr/bin/dump-pe /tmp/test1.exe
Error: 3 (Invalid section)
Location: ParsePEFromFile:2380
```

Fixes #109.
2020-03-09 12:47:16 -04:00
Eric Kilmer
68ab345297 Compile pepy with unicode_codecvt (#108)
Ideally, we would be able to autodetect which unicode library we want to
use, but this should hopefully work as a stop-gap solution.
2020-01-13 19:14:08 -05:00
Paul Kehrer
29a9c8ff04 remove travis CI (#104)
* remove travis CI

* also remove the coverity badge

we can re-add it if we add coverity back into the CI
2019-12-23 12:38:09 -05:00
Paul Kehrer
5a21e22292 Github actions (#103) 2019-12-23 10:28:47 -05:00
William Woodruff
2acb1fc975
Dockerfile: Dockerize pe-parse (#102)
Adds a default entrypoint for the dump-pe as well.
2019-12-06 13:36:08 -05:00
Stefan Siegfried
bd68ba418f Populate Rich header version strings (#94) 2019-11-16 17:45:55 +01:00
Jonas Kvinge
ea3970c9a0 Fix PEPARSE_INCLUDE_DIR for cross-compiling (#101) 2019-11-09 19:19:34 -05:00
William Woodruff
fe719c9b87
pe-parser-library, dump-pe: Windows.h accommodations (#99)
Makes it easier to use pe-parse in a translation unit where
Windows.h is also included.
2019-10-27 21:36:27 -04:00
William Woodruff
b4e2695921
travis: Add Windows build (#97) 2019-10-24 01:40:21 -04:00
William Woodruff
67a09499bf
parse: Fix unsafe cast (#96)
* parse: Fix unsafe cast

* parse: Fix uninitialized warning

This is a false positive from cl.exe's /W4: We only
use this variable in a branch where it ends up initialized.
2019-10-24 01:15:56 -04:00
William Woodruff
40987e1f7e
pe-parser-library: Fix GetDataDirectoryEntry (#95)
* pe-parser-library: Fix GetDataDirectoryEntry

Avoids UB.

* pe-parser-library: clang-format

* pe-parser-library: Use ref
2019-10-21 19:51:41 -04:00
William Woodruff
b3ab75577d
parse: Remove debug print 2019-10-21 12:18:18 -04:00
William Woodruff
2c775e5d6a
Directory entry retrieval (#90)
* pe-parser-library: Directory entry extraction

Also runs clang-format on all library files.

* dump-pe: Refactor, clang-format

* pe-parser-library: Use enum for directory kinds

* travis: Refactor

* travis: Fixup stages

* travis: Fix matrix

* examples, pe-parser-library, pepy: clang-format

* travis: Use minimal for lint

* travis: Use find

* clang-format: Remove old option

* travis: More experimentation

* travis: Move addons

* travis: Remove coverity

* travis: Hackery

* travis: Move addons up

* .travis: clang-format-8

* examples: clang-format

* travis: Fix homebrew

* CONTRIBUTING: Add contrib guidelines

* travis: Build python ext, reenable coverity

Remove old build files.

* travis: Re-add coverity secret

* travis: Build with coverity in a separate dir
2019-10-21 09:00:54 -04:00
Stefan Siegfried
1544c61c38 Initial impl. of Rich header parser. (#89)
* Initial impl. of Rich header parser. Closes trailofbits/pe-parse#83

* Fix const correctness per @woodruffw PR review
2019-10-14 15:57:54 -04:00
Jack Williams
6ee67f63e1 Icu and codecvt 2 (#88)
* Support for Windows codecvt and icu4c

* Add dependency for Travis

* Update README

* Fix codecvt build for linux

* Fix linux builds

* Fix copyright
2019-09-16 20:59:24 -04:00
Jack Williams
d2f74fadb0 Revert pepy change (#87) 2019-09-08 22:34:09 -04:00
redfast00
fece2ae3de Fix 'type qualifiers ignored on cast result type' warning (#85) 2019-08-29 14:19:24 -04:00
Jack Williams
724247d321 Goodness for dump-pe utility (#80) 2018-10-16 17:37:48 -04:00