search

BoomerangDecompiler / boomerang

Boomerang Decompiler - Fighting the code-rot :)
Other
372 stars 59 forks source link

DOS MZ Exe misidentified as NE exe #146

Closed powerbf closed 5 years ago

powerbf commented 5 years ago

OS: Linux Mint 19 Output of 'boomerang-cli --version' boomerang-cli v0.4.0-alpha-114-gfc67dfb2

My DOS MZ EXE was incorrectly identified as an NE EXE because it happens to have reloc table offset = 40h in the header

Steps to reproduce:

  1. boomerang-cli hello.exe

Expected/desired behaviour Should be identified as DOS MZ exe

Actual behaviour Identified as NE exe

Additional comments Checking for reloc table offset = 0x40 is not a realiable way to identify NE Exes. A more reliable way is to check whether the word at 0x3C contains the offset of a NE header (which starts with the signature 'NE'). Ref: https://www.fileformat.info/format/exe/corion-mz.htm

powerbf commented 5 years ago

Here is my exe and its source code: hello.zip

powerbf commented 5 years ago

I've raised pull request #147 containing a fix