search

avast / retdec

RetDec is a retargetable machine-code decompiler based on LLVM.
https://retdec.com/
MIT License
8.05k stars 951 forks source link

fileinfo: Detection of overlay content type #416

Open metthal opened 6 years ago

metthal commented 6 years ago

Overlay data appended to executable files are not part of the executable image but they are often used to store configuration/another MZ(PE) files/payloads/etc. We should detect the content type of overlay in the same way as in #414. This information can be valuable for analysts and other tools where fileinfo is part of the toolchain.

mbandzi commented 6 years ago

This is sometimes also used in cpdetect. If implemented, this may be later used to simplify cpdetect code. When it comes to overlay, I would also include archives (rar, zip...) to categories mentioned in #414.