VarFileInfo not fully parsed for VB application

[GoogleCodeExporter]

For the Visual Basic programs where the VarFileInfo is first and then
StringFileInfo, the VarFileInfo is incompletely parsed (it has no Var member). 

What steps will reproduce the problem?
1. pe.dump_info() for a MS Visual Basic program with version information
(imports MSVBVM60.dll)
2. The Var info is not printed (no Translation section, although it is
present in the file)

What is the expected output? What do you see instead?

[VarFileInfo]
Length:                        0x44      
ValueLength:                   0x0       
Type:                          0x0       

[StringFileInfo]
Length:                        0x12C     
ValueLength:                   0x0       
Type:                          0x1       

  [StringTable]
  Length:                        0x108     
  ValueLength:                   0x0       
  Type:                          0x1       
  LangID: 041004B0

    ProductVersion: 1.00
    InternalName: test
    FileVersion: 1.00
    OriginalFilename: test
    ProductName: test

There is no [Var] section but it should have existed.

What version of the product are you using? On what operating system?

Python 2.6 (Windows) ; pefile pefile-1.2.9.10-63

Original issue reported on code.google.com by constant...@gmail.com on 12 Jan 2010 at 10:42

[GoogleCodeExporter]

Original comment by ero.carr...@gmail.com on 17 Aug 2010 at 5:00

[GoogleCodeExporter]

I see the same thing. The problem is the "Type: 0x0" on the VarFileInfo struct. 
The code says "if stringfileinfo_struct.Type == 1 and 
stringfileinfo_struct.ValueLength == 0:" with no else clause, so this data is 
silently dropped.  The same goes for StringTable. Microsoft documents wType==0 
as "binary data" at 
http://msdn.microsoft.com/en-us/library/ms646987%28v=vs.85%29.aspx but I can't 
find anywhere that defines the structure for that that binary data. Perhaps 
it's proprietary per key?

In my case, I have a binary StringTable that contains the FileVersion, 
ProductVersion, etc. But the "binary data" appears to be just zero-terminated 
wchars...

Original comment by cjdo...@gmail.com on 20 Jun 2011 at 8:36

[GoogleCodeExporter]

If anybody finds docs about the format I'll try to make it parse it as well. 
Alternatively, if anybody manages to figure out the right format and writes a 
patch I'll take that ;-)
Will mark as WontFix for the time being.

Original comment by ero.carr...@gmail.com on 1 Aug 2011 at 2:50

• Changed state: WontFix

[GoogleCodeExporter]

Actually attempting to parse the cases where "stringfileinfo_struct.Type = 0" 
seems to lead to successful parsing. Revision 111 will do that and seemingly 
parse the information correctly.

Original comment by ero.carr...@gmail.com on 1 Aug 2011 at 7:16

• Changed state: Fixed