PE binaries should be handled as 'fat' binaries

[radare]

They can contain a DOS program, Windows one and .NET runtime. each code is located at different range.

r2 -A .net hello.exe  -> -a msil -b 32/64
r2 -A pe hello.exe -> -a x86/arm -b 32/64
r2 -A dos hello.exe -> -a x86 -b 16  # MZ

Default loaded subbin should be the newest (.net > win > dos) https://github.com/VirusTotal/yara/blob/master/libyara/modules/dotnet.c

[XVilka]

@radare isn't this already done?

[radare]

nope, this is not done yet.

[lionaneesh]

I am working on this

[radare]

👍

On 13 Mar 2016, at 22:21, Aneesh Dogra [email protected] wrote:

I am interested in working on this.

— Reply to this email directly or view it on GitHub.

[Maijin]

Here is a good binary example for that here: (waiting end of CTF)

[Maijin]

Ok here is the bin:

CHIMERA.ZIP

[XVilka]

@xarkes for you to think, what part can be done during GSoC, if possible, or not. Depending on how much changes are needed.

[Maijin]

See https://github.com/radare/radare2/pull/10835