Open pesco opened 7 years ago
Thanks for letting me know. It's been a while since I wrote the PEiD parsing code. I don't believe I ever aimed at perfect compatibility, as you point out, there are patterns whose meaning does not appear entirely clear. If there were some documentation about the format, please let me know; I could take a look. I'd also accept any PRs to improve the parsing :-)
Exeinfo Pe not support : "J", "V" or similar codes if you use external userdb.txt file.
While researching the PEiD "userdb.txt" format, I came across your code and decided to have a look at how you handle some of the obscure pattern features I found in the following file that I used as a reference: https://github.com/ynadji/peid/blob/master/userdb.txt
From reading, it seems that your code does not handle the cases I had in mind, leading (I guess) to patterns being misinterpreted.
?A
andA?
where A denotes a hex digit.Jx
where x is a decimal digit (I've seenJ1
andJ3
). I don't know what these mean.Patterns of the form
Vx
where x is a decimal digit (I've seenV3
andV4
). These seem to correspond to substitutions in the name, for example:[Adobe PDF (Portable document) Version %v3.%v4] signature = 25 50 44 46 2D V3 2E V4
The file I mentioned contains 178 signatures that show one of the above features; 28 nibble patterns, 34 trailing nibbles, 128 "J" patterns, and 6 "V" patterns.
In addition, some patterns seem to contain plain text parts, e.g.:
I'm not sure how to interpret these.