search

CybOXProject / schemas

CybOX Schemas and Schema Development
42 stars 17 forks source link

Break Out PE Optional Header DLL Characteristics into Multiple Elements #302

Open ikiril01 opened 10 years ago

ikiril01 commented 10 years ago

In the PEOptionalHeaderType of the Windows Executable File Object, we use a single element for capturing the DLL Characteristics. These can be reported as separate entries (e.g. IMAGE_DLL_CHARACTERISTICS_NX_COMPAT), so we should consider allowing for the characterization of these broken out entries instead of forcing them to be glommed together in a single field.

ikiril01 commented 9 years ago

This would likely entail creating a new "PEDLLCharacteristicsType", that contains a "Characteristic" element with a multiplicity of 1-N, for capturing the individual DLL characteristics.