search

Vector35 / binaryninja-api

Public API, examples, documentation and issues for Binary Ninja
https://binary.ninja/
MIT License
927 stars 209 forks source link

PE view discards the DLL name info of forwarded exports #4641

Closed xusheng6 closed 1 year ago

xusheng6 commented 1 year ago

In https://github.com/Vector35/view-pe/blob/d2503f60c704b5d20698894d06598c565c912c46/peview.cpp#L2472-L2486, the code parses the dll name and function name of a string like dll.func, but it subsequently discards the DLL name and no longer uses it. We should at least retain the DLL name

In other words, the symbol's name now looks like __forwarder_name(GetFileVersionInfoExA), and I think it would be better to be __forwarder_name(vresion.GetFileVersionInfoExA)

xusheng6 commented 1 year ago

Related to https://github.com/mandiant/capa/issues/1646