Detection Logic
// MZ signature at offset 0 and ...
uint16(0) == 0x5A4D and
// ... PE signature at offset stored in MZ header at 0x3C
uint32(uint32(0x3C)) == 0x00004550 and
(IsPE32 or IsPE64) and
( //Import_Table_RVA+Import_Data_Size .. cannot be outside imagesize
((uint32(uint32(0x3C)+0x80+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5) )) + (uint32(uint32(0x3C)+0x84+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5)))) > (uint32(uint32(0x3C)+0x50))
or
(((uint32(uint32(0x3C)+0x80+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5) )) + (uint32(uint32(0x3C)+0x84+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5)))) == 0x0)
//or
//doest work
//pe.imports("", "")
//need to check if this is ok.. 15:06 2016-08-12
//uint32( uint32(uint32(0x3C)+0x80+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5))+uint32(uint32(0x3C)+0x34)) == 0x408000
//this works..
//uint32(uint32(0x3C)+0x80+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5))+uint32(uint32(0x3C)+0x34) == 0x408000
//uint32be(uint32be(0x409000)) == 0x005A
//pe.image_base
//correct:
//uint32(uint32(0x3C)+0x80)+pe.image_base == 0x408000
//this works (file offset):
//$a0 at 0x4000
//this does not work rva:
//$a0 at uint32(0x0408000)
//(uint32(uint32(uint32(0x3C)+0x80)+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5))+pe.image_base) == 0x0)
or
//tiny PE files..
(uint32(0x3C)+0x80+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5) > filesize)
//or
//uint32(uint32(0x3C)+0x80) == 0x21000
//uint32(uint32(uint32(0x3C)+0x80)) == 0x0
//pe.imports("", "")
) Field Validations
Loading…
Comments (0)
Loading comments...