CybOXProject / schemas

CybOX Schemas and Schema Development
42 stars 17 forks source link

WindowExecutableFileType/DOSHeaderType is specified incorrectly. #419

Open rpiazza opened 8 years ago

rpiazza commented 8 years ago

In the DOSHeaderType, we have the following two properties/fields:

<xs:element name="reserved1" type="cyboxCommon:HexBinaryObjectPropertyType" minOccurs="0" maxOccurs="4">
    <xs:annotation>
           <xs:documentation>Specifies reserved words for the program (known in winnt.h as e_res[4]), usually set to zero by the linker. In this case, just use a single reserved1 set to zero; if not zero create four reserved1 with the correct value.</xs:documentation>
    </xs:annotation>
</xs:element>

and

 <xs:element name="reserved2" type="cyboxCommon:HexBinaryObjectPropertyType" minOccurs="0">
    <xs:annotation>
           <xs:documentation>Specifies reserved words for the program (known in winnt.h as e_res[10]), usually set to zero by the linker. In this case, just use a single reserved1 set to zero; if not zero create ten reserved1 with the correct value.</xs:documentation>
    </xs:annotation>
</xs:element>

In the doc for reserved2, it says in some cases there should be ten reserved1 values, but reserved1 is 0..4

Is 0..4 wrong, or should the doc for reserved2 say reserved2 and it be 0..10?

Google says the latter - https://en.wikibooks.org/wiki/X86_Disassembly/Windows_Executable_Files