hasherezade / pe-sieve

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
https://hshrzd.wordpress.com/pe-sieve/
BSD 2-Clause "Simplified" License
3.06k stars 425 forks source link

Fix target setting for PESIEVE_AS_STATIC_LIB #67

Closed hillu closed 4 years ago

hillu commented 4 years ago

Apparently, ARCHIVE DESTINATION is overwritten by the second install statement, leading to the following error message:

CMake Error at CMakeLists.txt:238 (install):
  install TARGETS given no ARCHIVE DESTINATION for static library target
  "pe-sieve".
hasherezade commented 4 years ago

unfortunately, this is not a good fix, because it breaks installation of other PE-sieve based projects, that relies of the pe-sieve.dll being dropped directly into the ${CMAKE_INSTALL_PREFIX} directory.

Would something like this help?

if (PESIEVE_AS_STATIC_LIB OR PESIEVE_AS_DLL)
    include(GNUInstallDirs)
    install(TARGETS ${PROJECT_NAME}
        ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}
        LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
        RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
    )
endif()

if (NOT PESIEVE_AS_STATIC_LIB)
    install(TARGETS ${PROJECT_NAME}
        DESTINATION ${CMAKE_INSTALL_PREFIX} COMPONENT ${PROJECT_NAME}
    )
endif()
hillu commented 4 years ago

Sure, that works. Updated the PR.

hasherezade commented 4 years ago

does it still cause problems if you try to switch to PESIEVE_AS_DLL though?

hillu commented 4 years ago

No cmake problems with PESIEVE_AS_DLL. Doesn't cross-compile, but this seems unrelated:

$SRCDIRpe_sieve_api.cpp:34:25: error: external linkage required for symbol ‘PESieve_version’ because of ‘dllexport’ attribute
 const DWORD PESIEVE_API PESieve_version = pesieve::PESIEVE_VERSION_ID;
                         ^~~~~~~~~~~~~~~
hasherezade commented 4 years ago

@hillu Thank you! I made one more change in the code, that could possibly fix the other bug. Can you check if it helps?

hillu commented 4 years ago

Sorry, it does not work as of 1804d9ffbd5f048c6ef40054a37b50dfc243804e

hasherezade commented 4 years ago

I see... Thanks for checking.