Potential deletion of same PE files during nested update extraction

nsacyber / BAM

The Binary Analysis Metadata tool gathers information about Windows binaries to aid in their analysis. #nsacyber

Other

153 stars 27 forks source link

Potential deletion of same PE files during nested update extraction #6

Closed iadgovuser8 closed 5 years ago

iadgovuser8 commented 5 years ago

It is possible that a PE file with the same name, but different versions from the same named nested update are extracted and overwritten. BAM! will record the existence of this file during processing, but the file does not exist.