pype32
pype32 copied to clipboard
Fix unordered streams parsing
When parsing streams, we can't detect them by thier index, because the order not consistent. we should use sections' names only.
This change will unfortunately break compatiblity with some files (e.g. some Luminosity Link malware samples), see issue https://github.com/crackinglandia/pype32/issues/9.
According to this blog post the metadata stream can either have the name "#~" or "#-" so we can probably replace the index based part (that was originally intended to fix it) with an added check for "#-": https://codingwithspike.wordpress.com/2012/09/01/building-a-net-disassembler-part-4-reading-the-metadata-tables-in-the-stream/
E.g. you just need to replace if name == "#~":
with if name in ("#~", "#-"):
on lines 1412 and 1434.