Skip to content

Commit

Permalink
Merge pull request #776 from avast/LZ_RetdecUnpackerSections
Browse files Browse the repository at this point in the history
* gu_idata and gu_rsrc section names are now considered packer sections
  • Loading branch information
metthal authored Jun 11, 2020
2 parents c1ecff3 + 0e93f4d commit f928c94
Showing 1 changed file with 17 additions and 11 deletions.
28 changes: 17 additions & 11 deletions src/fileformat/file_format/pe/pe_format.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -402,6 +402,8 @@ const std::unordered_set<std::string> usualPackerSections
"pec4",
"pec5",
"pec6",
"gu_idata", // Created by retdec-unpacker
"gu_rsrc" // Created by retdec-unpacker
};

const std::map<std::string, std::size_t> usualSectionCharacteristics
Expand Down Expand Up @@ -3794,20 +3796,24 @@ void PeFormat::scanForSectionAnomalies(unsigned anamaliesLimit)
continue;
}

// scan for overlapping sections
auto secStart = sec->getOffset();
auto secEnd = secStart + sec->getSizeInFile();
const auto cmpName = cmpSec->getName();
auto cmpSecStart = cmpSec->getOffset();
auto cmpSecEnd = cmpSecStart + cmpSec->getSizeInFile();
if ((secStart <= cmpSecStart && cmpSecStart < secEnd) ||
(cmpSecStart <= secStart && secStart < cmpSecEnd))
// scan for overlapping sections.
// DO NOT check if the previous section has zero size.
if(sec->getSizeInFile() != 0)
{
const std::string cmpMsgName = cmpName.empty() ? std::to_string(cmpSec->getIndex()) : cmpName;
anomalies.emplace_back(
auto secStart = sec->getOffset();
auto secEnd = secStart + sec->getSizeInFile();
const auto cmpName = cmpSec->getName();
auto cmpSecStart = cmpSec->getOffset();
auto cmpSecEnd = cmpSecStart + cmpSec->getSizeInFile();
if((secStart <= cmpSecStart && cmpSecStart < secEnd) ||
(cmpSecStart <= secStart && secStart < cmpSecEnd))
{
const std::string cmpMsgName = cmpName.empty() ? std::to_string(cmpSec->getIndex()) : cmpName;
anomalies.emplace_back(
"OverlappingSections",
"Sections " + pmsgName + " and " + replaceNonprintableChars(cmpMsgName) + " overlap"
);
);
}
}
}
}
Expand Down

0 comments on commit f928c94

Please sign in to comment.