Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Handle coded index variable sizes #7

Merged
3 commits merged into from
Jun 15, 2016
Merged

Conversation

iximeow
Copy link
Contributor

@iximeow iximeow commented Jun 15, 2016

If a .NET assembly has a table large enough to trip a coded index into the larger 4-byte format rather than the 2-byte format, getnetguids.py would get totally thrown for a loop and read guids from somewhat arbitrary places.

is fix nao

Resolves #6

Also helps-with-but-doesn't-quite-solve #4, where there's also some strangeness at play with the #- metadata tables' uncompressed data, rather than the normal #~ compressed metadata.

Andy Wortman added 3 commits June 14, 2016 17:05
Since typelib ids are recorded as a GuidAttribute on an assembly, any
guids from other CustomAttribute entries that are not on an assembly and
are not constructed from a MemberRef can be discarded.

MemberRef can be used to filter because GuidAttribute comes from
mscorlib, so unless we're looking at mscorlib itself GuidAttribute will
always be constructed using a MemberRef into another assembly.
If higher-index tables were not present, but their row count affects a
coded index, the row_count array may not have been large enough to index
for all tables the coded index can reach.

As a fix, ensure the row_count table is always 64 entries.
@ghost ghost merged commit 3aed213 into cylance:master Jun 15, 2016
@ghost
Copy link

ghost commented Jun 15, 2016

Thanks!

This pull request was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Inconsistency on file with hash d75d526893b503ab81c6298bab91083a7a9da35adce0709433c10e925592d0c6
1 participant