Skip to content

Handle coded index variable sizes#7

Merged
3 commits merged intocylance:masterfrom
iximeow:coded-index-sizes
Jun 15, 2016
Merged

Handle coded index variable sizes#7
3 commits merged intocylance:masterfrom
iximeow:coded-index-sizes

Conversation

@iximeow
Copy link
Copy Markdown
Contributor

@iximeow iximeow commented Jun 15, 2016

If a .NET assembly has a table large enough to trip a coded index into the larger 4-byte format rather than the 2-byte format, getnetguids.py would get totally thrown for a loop and read guids from somewhat arbitrary places.

is fix nao

Resolves #6

Also helps-with-but-doesn't-quite-solve #4, where there's also some strangeness at play with the #- metadata tables' uncompressed data, rather than the normal #~ compressed metadata.

Andy Wortman added 3 commits June 14, 2016 17:05
Since typelib ids are recorded as a GuidAttribute on an assembly, any
guids from other CustomAttribute entries that are not on an assembly and
are not constructed from a MemberRef can be discarded.

MemberRef can be used to filter because GuidAttribute comes from
mscorlib, so unless we're looking at mscorlib itself GuidAttribute will
always be constructed using a MemberRef into another assembly.
If higher-index tables were not present, but their row count affects a
coded index, the row_count array may not have been large enough to index
for all tables the coded index can reach.

As a fix, ensure the row_count table is always 64 entries.
@ghost ghost merged commit 3aed213 into cylance:master Jun 15, 2016
@ghost
Copy link
Copy Markdown

ghost commented Jun 15, 2016

Thanks!

This pull request was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Inconsistency on file with hash d75d526893b503ab81c6298bab91083a7a9da35adce0709433c10e925592d0c6

1 participant