search

hasherezade / pe-sieve

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
https://hshrzd.wordpress.com/pe-sieve/
BSD 2-Clause "Simplified" License
2.97k stars 420 forks source link

Lots of compiler warnings #64

Closed FuccDucc closed 2 years ago

FuccDucc commented 4 years ago

Hi,

There are so many warnings in this projects that I'm starting to think you have something to catch up to. All line numbers below correspond to unmodified master @ 443926a

pe-sieve\scanners\iat_scanner.cpp(43): warning C4244: 'argument': conversion from 'T_FIELD' to 'DWORD', possible loss of data
          with
          [
              T_FIELD=ULONGLONG
          ]
  ..\..\..\scanners\iat_scanner.cpp(24): note: see reference to function template instantiation 'bool pesieve::ImportInfoCallback::processThunks_tpl<ULONGLONG,IMAGE_THUNK_DATA64>(LPSTR,T_IMAGE_THUNK_DATA *,T_FIELD *,T_FIELD)' being compiled
          with
          [
              T_IMAGE_THUNK_DATA=IMAGE_THUNK_DATA64,
              T_FIELD=ULONGLONG
          ]
pe-sieve\scanners\iat_scanner.cpp(49): warning C4244: 'argument': conversion from 'T_FIELD' to 'DWORD', possible loss of data
          with
          [
              T_FIELD=ULONGLONG
          ]

pe-sieve\scanners\pe_section.h(57): warning C4267: 'initializing': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\pe_section.h(82): warning C4267: 'initializing': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\code_scanner.cpp(214): warning C4267: 'initializing': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\code_scanner.cpp(214): warning C4267: 'initializing': conversion from 'size_t' to 'const DWORD', possible loss of data
pe-sieve\scanners\code_scanner.cpp(216): warning C4267: 'argument': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\pe_section.h(57): warning C4267: 'initializing': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\pe_section.h(82): warning C4267: 'initializing': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\pe_buffer.cpp(102): warning C4267: 'argument': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\pe_buffer.cpp(106): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\pe_buffer.cpp(107): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\pe_section.h(57): warning C4267: 'initializing': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\pe_section.h(82): warning C4267: 'initializing': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\pe_section.h(57): warning C4267: 'initializing': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\pe_section.h(82): warning C4267: 'initializing': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\scan_report.cpp(171): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\scan_report.cpp(172): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\scan_report.cpp(173): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\scan_report.cpp(174): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\scan_report.cpp(175): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\scan_report.cpp(176): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\imp_rec\imp_reconstructor.h(129): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\imp_rec\iat_block.cpp(69): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\pe_reconstructor.cpp(50): warning C4267: '=': conversion from 'size_t' to 'LONG', possible loss of data
pe-sieve\postprocessors\pe_reconstructor.h(40): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
  ..\..\..\postprocessors\pe_reconstructor.cpp(279): note: see reference to function template instantiation 'bool pesieve::overwrite_opt_hdr<IMAGE_OPTIONAL_HEADER64>(BYTE *,size_t,IMAGE_OPTIONAL_HEADER_T *,pesieve::PeArtefacts &)' being compiled
          with
          [
              IMAGE_OPTIONAL_HEADER_T=IMAGE_OPTIONAL_HEADER64
          ]

pe-sieve\postprocessors\imp_rec\imp_reconstructor.h(129): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\imp_rec\imp_reconstructor.cpp(257): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\imp_rec\imp_reconstructor.cpp(264): warning C4244: 'initializing': conversion from '__int64' to 'DWORD', possible loss of data
pe-sieve\postprocessors\imp_rec\imp_reconstructor.cpp(276): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\imp_rec\imp_reconstructor.cpp(313): warning C4267: 'argument': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\imp_rec\imp_reconstructor.cpp(316): warning C4267: 'initializing': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\imp_rec\imp_reconstructor.cpp(316): warning C4267: 'initializing': conversion from 'size_t' to 'const DWORD', possible loss of data
pe-sieve\postprocessors\imp_rec\imp_reconstructor.cpp(329): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\imp_rec\imp_reconstructor.cpp(338): warning C4267: 'initializing': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\imp_rec\imp_reconstructor.cpp(338): warning C4267: 'initializing': conversion from 'size_t' to 'const DWORD', possible loss of data
pe-sieve\postprocessors\imp_rec\imp_reconstructor.cpp(378): warning C4267: '+=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\imp_rec\iat_finder.h(47): warning C4244: 'initializing': conversion from '__int64' to 'DWORD', possible loss of data
  pe-sieve\postprocessors\imp_rec\iat_finder.h(91): note: see reference to function template instantiation 'size_t pesieve::fill_iat<FIELD_T>(BYTE *,size_t,const peconv::ExportsMapper *,pesieve::IATBlock &)' being compiled
          with
          [
              FIELD_T=ULONGLONG
          ]
  ..\..\..\postprocessors\imp_rec\iat_finder.cpp(13): note: see reference to function template instantiation 'pesieve::IATBlock *pesieve::find_iat<ULONGLONG>(bool,BYTE *,size_t,const peconv::ExportsMapper *,size_t)' being compiled

pe-sieve\libpeconv\libpeconv\src\pe_hdrs_helper.cpp(579): warning C4244: 'return': conversion from 'SIZE_T' to 'DWORD', possible loss of data
pe-sieve\libpeconv\libpeconv\src\pe_hdrs_helper.cpp(589): warning C4244: 'return': conversion from 'SIZE_T' to 'DWORD', possible loss of data
pe-sieve\utils\process_reflection.cpp(191): warning C4311: 'type cast': pointer truncation from 'HANDLE' to 'DWORD'
pe-sieve\utils\process_reflection.cpp(191): warning C4302: 'type cast': truncation from 'HANDLE' to 'DWORD'
pe-sieve\libpeconv\libpeconv\src\delayed_imports_loader.cpp(87): warning C4311: 'type cast': pointer truncation from 'FARPROC' to 'T_FIELD'
          with
          [
              T_FIELD=DWORD
          ]
  ..\..\..\libpeconv\libpeconv\src\delayed_imports_loader.cpp(146): note: see reference to function template instantiation 'bool parse_delayed_desc<DWORD,IMAGE_THUNK_DATA32>(BYTE *,const size_t,const ULONGLONG,LPSTR,const T_FIELD,IMAGE_DELAYLOAD_DESCRIPTOR *,peconv::t_function_resolver *)' being compiled
          with
          [
              T_FIELD=DWORD
          ]
pe-sieve\libpeconv\libpeconv\src\delayed_imports_loader.cpp(87): warning C4302: 'type cast': truncation from 'FARPROC' to 'T_FIELD'
          with
          [
              T_FIELD=DWORD
          ]

pe-sieve\libpeconv\libpeconv\src\imports_loader.cpp(60): warning C4311: 'reinterpret_cast': pointer truncation from 'FARPROC' to 'T_FIELD'
          with
          [
              T_FIELD=DWORD
          ]
  ..\..\..\libpeconv\libpeconv\src\imports_loader.cpp(24): note: see reference to function template instantiation 'bool FillImportThunks::processThunks_tpl<DWORD,IMAGE_THUNK_DATA32>(LPSTR,T_IMAGE_THUNK_DATA *,T_FIELD *,T_FIELD)' being compiled
          with
          [
              T_IMAGE_THUNK_DATA=IMAGE_THUNK_DATA32,
              T_FIELD=DWORD
          ]
pe-sieve\libpeconv\libpeconv\src\imports_loader.cpp(60): warning C4302: 'reinterpret_cast': truncation from 'FARPROC' to 'T_FIELD'
          with
          [
              T_FIELD=DWORD
          ]

pe-sieve\libpeconv\libpeconv\src\file_util.cpp(85): warning C4267: 'argument': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\libpeconv\libpeconv\src\exports_lookup.cpp(114): warning C4311: 'reinterpret_cast': pointer truncation from 'LPSTR' to 'DWORD'
pe-sieve\libpeconv\libpeconv\src\exports_lookup.cpp(114): warning C4302: 'reinterpret_cast': truncation from 'LPSTR' to 'DWORD'
pe-sieve\libpeconv\libpeconv\src\exports_lookup.cpp(158): warning C4311: 'reinterpret_cast': pointer truncation from 'LPSTR' to 'DWORD'
pe-sieve\libpeconv\libpeconv\src\exports_lookup.cpp(158): warning C4302: 'reinterpret_cast': truncation from 'LPSTR' to 'DWORD'
pe-sieve\libpeconv\libpeconv\src\imports_uneraser.cpp(155): warning C4244: '=': conversion from 'const DWORD' to 'WORD', possible loss of data
  ..\..\..\libpeconv\libpeconv\src\imports_uneraser.cpp(218): note: see reference to function template instantiation 'bool peconv::ImportsUneraser::writeFoundFunction<FIELD_T,IMAGE_THUNK_DATA_T>(IMAGE_THUNK_DATA_T *,const FIELD_T,const peconv::ExportedFunc &)' being compiled
          with
          [
              FIELD_T=DWORD,
              IMAGE_THUNK_DATA_T=IMAGE_THUNK_DATA32
          ]
  ..\..\..\libpeconv\libpeconv\src\imports_uneraser.cpp(234): note: see reference to function template instantiation 'bool peconv::ImportsUneraser::fillImportNames<DWORD,IMAGE_THUNK_DATA32>(IMAGE_IMPORT_DESCRIPTOR *,const FIELD_T,std::map<ULONGLONG,std::set<peconv::ExportedFunc,std::less<peconv::ExportedFunc>,std::allocator<peconv::ExportedFunc>>,std::less<ULONGLONG>,std::allocator<std::pair<const ULONGLONG,std::set<peconv::ExportedFunc,std::less<peconv::ExportedFunc>,std::allocator<peconv::ExportedFunc>>>>> &,peconv::ImpsNotCovered *)' being compiled
          with
          [
              FIELD_T=DWORD
          ]

pe-sieve\libpeconv\libpeconv\src\fix_dot_net_ep.cpp(73): warning C4267: 'initializing': conversion from 'size_t' to 'int', possible loss of data
FuccDucc commented 4 years ago

Updated list of warnings (as of master d33ac6b):

pe-sieve\scanners\pe_section.h(57): warning C4267: 'initializing': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\pe_section.h(82): warning C4267: 'initializing': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\code_scanner.cpp(214): warning C4267: 'initializing': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\code_scanner.cpp(214): warning C4267: 'initializing': conversion from 'size_t' to 'const DWORD', possible loss of data
pe-sieve\scanners\code_scanner.cpp(216): warning C4267: 'argument': conversion from 'size_t' to 'DWORD', possible loss of data

pe-sieve\scanners\iat_scanner.cpp(43): warning C4244: 'argument': conversion from 'T_FIELD' to 'DWORD', possible loss of data
          with
          [
              T_FIELD=ULONGLONG
          ]
  ..\..\..\scanners\iat_scanner.cpp(24): note: see reference to function template instantiation 'bool pesieve::ImportInfoCallback::processThunks_tpl<ULONGLONG,IMAGE_THUNK_DATA64>(LPSTR,T_IMAGE_THUNK_DATA *,T_FIELD *,T_FIELD)' being compiled
          with
          [
              T_IMAGE_THUNK_DATA=IMAGE_THUNK_DATA64,
              T_FIELD=ULONGLONG
          ]
pe-sieve\scanners\iat_scanner.cpp(49): warning C4244: 'argument': conversion from 'T_FIELD' to 'DWORD', possible loss of data
          with
          [
              T_FIELD=ULONGLONG
          ]

pe-sieve\scanners\pe_section.h(57): warning C4267: 'initializing': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\pe_section.h(82): warning C4267: 'initializing': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\pe_section.h(57): warning C4267: 'initializing': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\pe_section.h(82): warning C4267: 'initializing': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\scan_report.cpp(177): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\scan_report.cpp(178): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\scan_report.cpp(179): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\scan_report.cpp(180): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\scan_report.cpp(181): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\scan_report.cpp(183): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\scan_report.cpp(184): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\pe_section.h(57): warning C4267: 'initializing': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\scanners\pe_section.h(82): warning C4267: 'initializing': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\pe_reconstructor.cpp(50): warning C4267: '=': conversion from 'size_t' to 'LONG', possible loss of data

pe-sieve\postprocessors\pe_reconstructor.h(40): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
  ..\..\..\postprocessors\pe_reconstructor.cpp(279): note: see reference to function template instantiation 'bool pesieve::overwrite_opt_hdr<IMAGE_OPTIONAL_HEADER64>(BYTE *,size_t,IMAGE_OPTIONAL_HEADER_T *,pesieve::PeArtefacts &)' being compiled
          with
          [
              IMAGE_OPTIONAL_HEADER_T=IMAGE_OPTIONAL_HEADER64
          ]
pe-sieve\postprocessors\imp_rec\imp_reconstructor.h(129): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\pe_buffer.cpp(102): warning C4267: 'argument': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\pe_buffer.cpp(106): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\pe_buffer.cpp(107): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\imp_rec\imp_reconstructor.h(129): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\imp_rec\imp_reconstructor.cpp(257): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\imp_rec\imp_reconstructor.cpp(264): warning C4244: 'initializing': conversion from '__int64' to 'DWORD', possible loss of data
pe-sieve\postprocessors\imp_rec\imp_reconstructor.cpp(276): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\imp_rec\imp_reconstructor.cpp(313): warning C4267: 'argument': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\imp_rec\imp_reconstructor.cpp(316): warning C4267: 'initializing': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\imp_rec\imp_reconstructor.cpp(316): warning C4267: 'initializing': conversion from 'size_t' to 'const DWORD', possible loss of data
pe-sieve\postprocessors\imp_rec\imp_reconstructor.cpp(329): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\imp_rec\imp_reconstructor.cpp(338): warning C4267: 'initializing': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\imp_rec\imp_reconstructor.cpp(338): warning C4267: 'initializing': conversion from 'size_t' to 'const DWORD', possible loss of data
pe-sieve\postprocessors\imp_rec\imp_reconstructor.cpp(378): warning C4267: '+=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\imp_rec\iat_block.cpp(69): warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\postprocessors\imp_rec\iat_finder.h(47): warning C4244: 'initializing': conversion from '__int64' to 'DWORD', possible loss of data

  pe-sieve\postprocessors\imp_rec\iat_finder.h(91): note: see reference to function template instantiation 'size_t pesieve::fill_iat<FIELD_T>(BYTE *,size_t,const peconv::ExportsMapper *,pesieve::IATBlock &)' being compiled
          with
          [
              FIELD_T=ULONGLONG
          ]
  ..\..\..\postprocessors\imp_rec\iat_finder.cpp(13): note: see reference to function template instantiation 'pesieve::IATBlock *pesieve::find_iat<ULONGLONG>(bool,BYTE *,size_t,const peconv::ExportsMapper *,size_t)' being compiled

pe-sieve\libpeconv\libpeconv\src\pe_hdrs_helper.cpp(579): warning C4244: 'return': conversion from 'SIZE_T' to 'DWORD', possible loss of data
pe-sieve\libpeconv\libpeconv\src\pe_hdrs_helper.cpp(589): warning C4244: 'return': conversion from 'SIZE_T' to 'DWORD', possible loss of data
pe-sieve\utils\process_reflection.cpp(191): warning C4311: 'type cast': pointer truncation from 'HANDLE' to 'DWORD'
pe-sieve\utils\process_reflection.cpp(191): warning C4302: 'type cast': truncation from 'HANDLE' to 'DWORD'
pe-sieve\libpeconv\libpeconv\src\delayed_imports_loader.cpp(87): warning C4311: 'type cast': pointer truncation from 'FARPROC' to 'T_FIELD'
          with
          [
              T_FIELD=DWORD
          ]
  ..\..\..\libpeconv\libpeconv\src\delayed_imports_loader.cpp(146): note: see reference to function template instantiation 'bool parse_delayed_desc<DWORD,IMAGE_THUNK_DATA32>(BYTE *,const size_t,const ULONGLONG,LPSTR,const T_FIELD,IMAGE_DELAYLOAD_DESCRIPTOR *,peconv::t_function_resolver *)' being compiled
          with
          [
              T_FIELD=DWORD
          ]
pe-sieve\libpeconv\libpeconv\src\delayed_imports_loader.cpp(87): warning C4302: 'type cast': truncation from 'FARPROC' to 'T_FIELD'
          with
          [
              T_FIELD=DWORD
          ]
pe-sieve\libpeconv\libpeconv\src\imports_loader.cpp(60): warning C4311: 'reinterpret_cast': pointer truncation from 'FARPROC' to 'T_FIELD'
          with
          [
              T_FIELD=DWORD
          ]
  ..\..\..\libpeconv\libpeconv\src\imports_loader.cpp(24): note: see reference to function template instantiation 'bool FillImportThunks::processThunks_tpl<DWORD,IMAGE_THUNK_DATA32>(LPSTR,T_IMAGE_THUNK_DATA *,T_FIELD *,T_FIELD)' being compiled
          with
          [
              T_IMAGE_THUNK_DATA=IMAGE_THUNK_DATA32,
              T_FIELD=DWORD
          ]
pe-sieve\libpeconv\libpeconv\src\imports_loader.cpp(60): warning C4302: 'reinterpret_cast': truncation from 'FARPROC' to 'T_FIELD'
          with
          [
              T_FIELD=DWORD
          ]

pe-sieve\libpeconv\libpeconv\src\exports_lookup.cpp(114): warning C4311: 'reinterpret_cast': pointer truncation from 'LPSTR' to 'DWORD'
pe-sieve\libpeconv\libpeconv\src\exports_lookup.cpp(114): warning C4302: 'reinterpret_cast': truncation from 'LPSTR' to 'DWORD'
pe-sieve\libpeconv\libpeconv\src\exports_lookup.cpp(158): warning C4311: 'reinterpret_cast': pointer truncation from 'LPSTR' to 'DWORD'
pe-sieve\libpeconv\libpeconv\src\exports_lookup.cpp(158): warning C4302: 'reinterpret_cast': truncation from 'LPSTR' to 'DWORD'
pe-sieve\libpeconv\libpeconv\src\file_util.cpp(85): warning C4267: 'argument': conversion from 'size_t' to 'DWORD', possible loss of data
pe-sieve\libpeconv\libpeconv\src\imports_uneraser.cpp(155): warning C4244: '=': conversion from 'const DWORD' to 'WORD', possible loss of data
  ..\..\..\libpeconv\libpeconv\src\imports_uneraser.cpp(218): note: see reference to function template instantiation 'bool peconv::ImportsUneraser::writeFoundFunction<FIELD_T,IMAGE_THUNK_DATA_T>(IMAGE_THUNK_DATA_T *,const FIELD_T,const peconv::ExportedFunc &)' being compiled
          with
          [
              FIELD_T=DWORD,
              IMAGE_THUNK_DATA_T=IMAGE_THUNK_DATA32
          ]
  ..\..\..\libpeconv\libpeconv\src\imports_uneraser.cpp(234): note: see reference to function template instantiation 'bool peconv::ImportsUneraser::fillImportNames<DWORD,IMAGE_THUNK_DATA32>(IMAGE_IMPORT_DESCRIPTOR *,const FIELD_T,std::map<ULONGLONG,std::set<peconv::ExportedFunc,std::less<peconv::ExportedFunc>,std::allocator<peconv::ExportedFunc>>,std::less<ULONGLONG>,std::allocator<std::pair<const ULONGLONG,std::set<peconv::ExportedFunc,std::less<peconv::ExportedFunc>,std::allocator<peconv::ExportedFunc>>>>> &,peconv::ImpsNotCovered *)' being compiled
          with
          [
              FIELD_T=DWORD
          ]

pe-sieve\libpeconv\libpeconv\src\fix_dot_net_ep.cpp(73): warning C4267: 'initializing': conversion from 'size_t' to 'int', possible loss of data
hasherezade commented 4 years ago

Hi! I am well aware of those warnings - well, compiler displays them, so of course I saw them. But if you analyze them closer, you will find out that they are totally harmless - and inevitable when you want to process both 32 bit and 64 bit PEs in a generic way. Some fields in 64 bit PE have a ULONGLONG type, and the same fields in 32 bit PEs have a DWORD type. So, i.e. when you want to make a generic function for both, you will have to use the longer type: ULONGLONG and force-cast to the shorter type: DWORD on the occasion of parsing PE 32 bit. It do cause warnings, but it is an intended cast in this case, not something missing.