Skip to content

Fixed code syntax for an example #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Fixed code syntax for an example #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ba86ae7
Update latest doc
Feb 23, 2025
d4bf108
Fixed code syntax for an example
ShufflePerson Mar 13, 2025
1a10cd0
Fixed code syntax
ShufflePerson Mar 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
The diff you're trying to view is too large. We only load the first 3000 changed files.
126 changes: 63 additions & 63 deletions blog/2017-04-18-lief/index.html
View file
Open in desktop

Large diffs are not rendered by default.

316 changes: 158 additions & 158 deletions blog/2017-10-30-lief-0-8-3/index.html
View file
Open in desktop

Large diffs are not rendered by default.

72 changes: 36 additions & 36 deletions blog/2018-06-11-lief-0-9-0/index.html
View file
Open in desktop

Large diffs are not rendered by default.

36 changes: 18 additions & 18 deletions blog/2021-01-19-lief-0-11-0/index.html
View file
Open in desktop

Large diffs are not rendered by default.

12 changes: 6 additions & 6 deletions blog/2021-02-22-lief-0-11-1/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,13 +20,13 @@
February 22, 2021</span></div><img src=https://lief.re//img/waves.png class="d-block mx-auto mt-4 mb-5" alt=Wave><div class=text-dark><div class="admonition abstract"><p class=admonition-title>Tl;DR</p>LIEF v0.11.1 fixes some issues related to PE Authentihash computation. The new packages are available on PyPI and
the SDKs can be downloaded on the official <a href=https://lief.quarkslab.com/download/>website</a>.<p>Enjoy!</p></div><p>LIEF 0.11.0 missed handling some cases in the processing of the PE Authentihash. This new release addresses
these issues and the following blog post explains the cases we did not handle.</p><h3 id=section-name>Section name</h3><p>PE section&rsquo;s names are stored in a <strong>fixed</strong> char array (8 bytes) which means that a section&rsquo;s name can
contain trailing bytes after the null char:</p><div class=highlight><pre tabindex=0 style=background-color:#fff;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-cpp data-lang=cpp><span style=display:flex><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:.4em;padding:0 .4em;color:#7f7f7f">1</span><span><span style=color:#000;font-weight:700>struct</span> <span style=color:#458;font-weight:700>pe_section</span> {
</span></span><span style=display:flex><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:.4em;padding:0 .4em;color:#7f7f7f">2</span><span> <span style=color:#458;font-weight:700>char</span> name[<span style=color:#099>8</span>];
</span></span><span style=display:flex><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:.4em;padding:0 .4em;color:#7f7f7f">3</span><span> <span style=color:#458;font-weight:700>uint32_t</span> RVA;
</span></span><span style=display:flex><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:.4em;padding:0 .4em;color:#7f7f7f">4</span><span> <span style=color:#998;font-style:italic>// ...
</span></span></span><span style=display:flex><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:.4em;padding:0 .4em;color:#7f7f7f">5</span><span><span style=color:#998;font-style:italic></span>};
contain trailing bytes after the null char:</p><div class=highlight><pre tabindex=0 style=background-color:#fff;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-cpp data-lang=cpp><span style=display:flex><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:.4em;padding:0 .4em;color:#7f7f7f">1</span><span><span style=color:#cf222e>struct</span> <span style=color:#1f2328>pe_section</span> <span style=color:#1f2328>{</span>
</span></span><span style=display:flex><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:.4em;padding:0 .4em;color:#7f7f7f">2</span><span> <span style=color:#cf222e>char</span> name<span style=color:#1f2328>[</span><span style=color:#0550ae>8</span><span style=color:#1f2328>];</span>
</span></span><span style=display:flex><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:.4em;padding:0 .4em;color:#7f7f7f">3</span><span> <span style=color:#cf222e>uint32_t</span> RVA<span style=color:#1f2328>;</span>
</span></span><span style=display:flex><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:.4em;padding:0 .4em;color:#7f7f7f">4</span><span> <span style=color:#57606a>// ...
</span></span></span><span style=display:flex><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:.4em;padding:0 .4em;color:#7f7f7f">5</span><span><span style=color:#57606a></span><span style=color:#1f2328>};</span>
</span></span></code></pre></div><p>Before v0.11.1, LIEF didn&rsquo;t take into account the trailing bytes and stopped to read the section&rsquo;s name
on the first null char:</p><div class=highlight><pre tabindex=0 style=background-color:#fff;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-cpp data-lang=cpp><span style=display:flex><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:.4em;padding:0 .4em;color:#7f7f7f">1</span><span><span style=color:#000;font-weight:700>this</span><span style=color:#000;font-weight:700>-&gt;</span>name_ <span style=color:#000;font-weight:700>=</span> std<span style=color:#000;font-weight:700>::</span>string(header<span style=color:#000;font-weight:700>-&gt;</span>name, <span style=color:#000;font-weight:700>sizeof</span>(header<span style=color:#000;font-weight:700>-&gt;</span>name)).c_str();
on the first null char:</p><div class=highlight><pre tabindex=0 style=background-color:#fff;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-cpp data-lang=cpp><span style=display:flex><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:.4em;padding:0 .4em;color:#7f7f7f">1</span><span><span style=color:#cf222e>this</span><span style=color:#0550ae>-&gt;</span>name_ <span style=color:#0550ae>=</span> std<span style=color:#0550ae>::</span>string<span style=color:#1f2328>(</span>header<span style=color:#0550ae>-&gt;</span>name<span style=color:#1f2328>,</span> <span style=color:#cf222e>sizeof</span><span style=color:#1f2328>(</span>header<span style=color:#0550ae>-&gt;</span>name<span style=color:#1f2328>)).</span>c_str<span style=color:#1f2328>();</span>
</span></span></code></pre></div><p>This implementation has two drawbacks. First, we lose information since we don&rsquo;t store the extra trailing bytes.
Regular binaries have zero trailing bytes after the first null char but some of them might use this spot to
hide data.</p><p><img src=section_table_e.png alt="Section name with trailing bytes"></p><p>Secondly, the <strong>full</strong> section name (i.e the whole 8 bytes) is used to compute the Authentihash.
Expand Down
Loading