Corkami PE Testing - Known Failure Fixes

未关闭
  • 哪里不对？
#151 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
28/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
停滞
技术栈
cpp
领域
reverse-engineering

调研方向

运行 git submodule update --init，然后检查 tests/corkami_test.cpp，并对 Corkami PE 数据集使用 ./build/dump-pe，从 virtsectblXP.exe 及其引用的 assembly 开始。跟踪报告的解析失败，并将 PE 文件与其对应的 asm 源文件进行比较。完成的标准是消除已知的测试例外，并为 Corkami PE 添加字段级断言。

由索引模型根据 Issue 内容生成。

描述

help wanted testing

Within #145, there are very simple tests to detect whether pe-parse would correctly identify the executables as PE, without erroring. Unfortunately (but not unexpectedly), there are a few executables that are not parsed correctly.

Ideally, we should at least test and enforce that we support parsing of any PE in the Corkami dataset.

  • There are no test exceptions (read: known failures) when processing the Corkami dataset of PEs

Reference to known failing tests: https://github.com/trailofbits/pe-parse/blob/4286f109b0763972d1db7177ec6fe5f6791350f8/tests/corkami_test.cpp#L34-L51

Secondly, a much bigger task would be to confirm that pe-parse is correctly parsing all and only the information that the Corkami PEs claim to exhibit.

  • There are specific PE field tests/asserts for the Corkami PEs to ensure correctness

How to Start Investigating

First, run git submodule update --init to pull the Corkami dataset (We will be focusing on the PEs here https://github.com/corkami/pocs/tree/master/PE/bin).

Then, running the standalone dump-pe tool that is included in this repo should be an easy way to iterate on code changes, since the testing logic is basically the same.

$ ./build/dump-pe/dump-pe tests/assets/corkami-poc-dataset/PE/bin/virtsectblXP.exe
Error: 3 (Invalid section)
Location: ParsePEFromBuffer:2394

Use that information as a starting point for where to begin debugging. Moreover, most, if not all, of the PEs have a corresponding asm file that provides the source code for building the PE and how the file is constructed. Use this information to gain a better understanding of why pe-parse is having difficulty parsing it and what kind of fix would be needed. Here it is for our example https://github.com/corkami/pocs/blob/master/PE/virtsectblXP.asm

主要语言
C++
星标
912
派生
170
平均合并
8 小时 34 分钟
30 天内合并 PR
2

环境准备

  • 提供 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

trailofbits/pe-parse 的其他 Issue

查看 trailofbits/pe-parse 的全部 Issue

相似的 Issue

更多 C++ Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。