readpe
readpe copied to clipboard
mentebinaria
peres does not read shuffled resources
- Get the file resource_shuffled.exe from corkami, BinaryCorpus_v2.zip: https://code.google.com/p/corkami/downloads/detail?name=BinaryCorpus_v2.zip&can=2&q=
- Execute: peres -i resource_shuffled.exe
The output is: this file has no resources
The output should be something like: address: 0x12f0, size: 0x229, language -> ID: 0, name -> ID: 101, type -> ID: RT_RCDATA (extracted info with another tool)
This seems a bit tricky. The resources of this file don't seem to be placed in the resources directory, but somewhere else. I don't remember whether the spec allows this, but if it does, I think we can figure this out using a RVA. Will have to invest some time on this though.
Thank you for your fast replies. Even if the specification does not allow it (I am sure it doesn't), the windows loader does. It does not care about the size given in the data directory table, nor if the resource tree nodes are all in the same section.
Corkami files are in our TODO for a while now. It is a nice set of binaries that don't follow the specs yet run perfectly under Windows loader. Thanks for this, @katjahahn. We'll take some time to fix this, but we'll do that. ;)
I don't see an easy way to identify which directory is in which position since that is defined/guaranteed by their order/index.
We could traverse all directories, but IMAGE_DATA_DIRECTORY gives us only VirtualAddress and Size before we access the VirtualAddress (translated to an offset) to read an specific directory structure.
That would require a brute-force detection, or maybe I'm missing something.
Hum... @katjahahn do you know a tool that can read it correctly? I'd like to see its source code. 🙂
I used PortEx: https://github.com/katjahahn/PortEx/tree/master/src/main/java/com/github/katjahahn/parser/sections/rsrc However, it seems the resource_shuffled.exe is not in the corkami project anymore, so I cannot confirm that it works with the current version.
Does this help? http://pedump.me/401ed03adc85aa46708994cb5dbb7a89/ ?
It looks one could recreate the exe from http://pedump.me/401ed03adc85aa46708994cb5dbb7a89/#hexdump
PortEx ignores the directory table size entry all together. It seems like Windows also ignores it for at least resources which isn't too weird as it is sort of redundant. Commenting out the early return in pe_resource_base_ptr makes it work correctly and overall seems to not break anything from what I could tell.
