goblin

goblin copied to clipboard

Hi, are there any plans on providing an alternative API where the data is not Borrowed by the goblin objects? The current api is problematic, when i want to for...

mlgiraud

COFF stringtable created with 'strings' function truncates the first 4 characters when used with symbol offset

9

# Detailed Problem Description with Example A symbol with a name longer than 8 characters, will be stored in the string table, as per the PE File Format Documentation given...

DasStone

Failing to parse QEMU memory dump note .shstrtab

3

Hi, if you generate an ELF core file containing the memory dump of VM in QEMU (```qemu-system-x86_64``` than in console ```dump-guest-memory FILENAME```) and you parse it with a simple Rust...

IridiumXOR

PE: handle empty import address table

2

This [PE file](https://www.virustotal.com/gui/file/0000bab1a3b04d3013d126e4621abfe7ec87ba0eafac01a53ac51c4db747f65a) has a valid import lookup table but the pointer to the import address table is 0x0: goblin currently supports handling empty import lookup tables but not empty...

williballenthin

Hi, thanks for the great library! We're currently using it in a new package manager to read linked libraries and rpaths from `.so` and `.dylib` files. We need to rewrite...

wolfv

write support for PE / Signing PE for UEFI

2

As part of signing PE objects for booting UEFI payloads with secureboot, we (@RaitoBezarius and I) would need to add a PKCS#7 signature to PE objects. This comes along with...

baloo

Elf: match imported functions to libraries?

2

It seems that the Elf parser has the functionality to get the libraries which the binary will get at runtime, via the `elf.libraries` Vec. After playing around with the library,...

rjzak

It would be nice to be able to compute a PE binary "Authentihash" according to a hash algorithm. This basically requires hashing the whole PE binary except: Windows checksum field,...

RaitoBezarius

Integration with oss-fuzz fuzzing service

5

Hi @m4b, I would like to help integrate this project into [OSS-Fuzz](https://github.com/google/oss-fuzz). - As an initial step for integration I have created this PR: https://github.com/google/oss-fuzz/pull/8646, it contains necessary logic from...

manunio

add ability to parse OriginalFilename

3

MS doc: https://learn.microsoft.com/en-us/windows/win32/menurc/string-str?redirectedfrom=MSDN Yara rule support for field: https://yara.readthedocs.io/en/v3.2.0/modules/pe.html This is a useful field in threat hunting and forensics in general. thanks

theflakes