META - Portable Executable

[Maijin]

All Portable Executables

Related

• [ ] Doc - TBD
• Tests - https://github.com/radare/radare2-regressions/tree/master/t.formats/pe
• Commands involved - N/A
• [ ] BlogPost - TBD
• .c involved:
  • https://github.com/radare/radare2/blob/master/libr/bin/p/bin_pe.c

General Information

• [ ] Add DLL Characteristics in iI, iIj (Already parsed in SDB) #6785 Or in iH , iHj https://github.com/radare/radare2/issues/6759
• [ ] VTABLE detection for MSVC https://github.com/radare/radare2/issues/6851
• [x] Add authentihash and authentihash check in it and itj

R_BIN Enhancement

radare2-regressions files that are not properly parsed by r2 currently:

• [ ] d_resource.dll
• [ ] d_tiny.dll
• [ ] dosZMXP.exe
• [ ] exe2pe.exe
• [ ] no0code.exe

Analysis

• [ ] detect and rename the elements/structures accordingly. (See all the +ms_exc.registration.TryLevel etc...) see http://pastebin.com/aLrkiwuM reversing-demo.zip

Resources

• [ ] Add/remove/modify/dump Resources rabin2 -O && iO

Import/Export Table

• [ ] Ability to move the import table rabin2 -O && iO
• [ ] Ability to add/remove import/export library (with prior checks to see if possible) rabin2 -O && iO
• [ ] Ability to add/remove function to a library (with prior checks to see if possible) rabin2 -O && iO
• [ ] Ability to dump a process and reconstruct/manipulate IAT (ollydump + IMPrec tool / x64dbg) (https://github.com/OALabs/PyIATRebuild/blob/master/pyiatrebuild.py)
• [ ] Add PE unmapper https://github.com/hasherezade/malware_analysis/tree/master/pe_unmapper {as a r2e module}
• [ ] Implement the Windows API import recovery functionality shown in the apiscout: https://github.com/danielplohmann/apiscout -- (API import recovery: http://byte-atlas.blogspot.de/2017/04/apiscout.html) (https://github.com/danielplohmann/apiscout/issues/1)
• [ ] Add imphash https://github.com/Neo23x0/ImpHash-Generator {As a r2e module}

Rich Header

• [x] https://github.com/radare/radare2/issues/12889

Debug Informations

• [ ] Display debug file info: age

Sections

• [ ] Add sections headers into the pf output
• [ ] Ability to add/resize/move/... sections

SEH/VEH

• [ ] SEH Parser for PE 32 bits see http://blog.davidegrayson.com/2016/02/windows-32-bit-structured-exception.html
• [ ] SEH Parser for PE 64bits see https://github.com/tandasat/scripts_for_RE/blob/master/parse_x64_SEH.py

Specific Language Portable Executables

.NET

• [ ] Load and display .NET PE information in iI,iIj
• http://www.ntcore.com/files/dotnetformat.htm
• http://www.reddit.com/r/ReverseEngineering/comments/2cw2o2/pe_net_that_is_not_pe_net/
• https://blog.cylance.com/you-me-and-.net-guids See preliminary step - https://github.com/radare/radare2/issues/6771

Others

• [ ] A way to handle RFG
• [ ] A way to handle AutoIT PE
• [ ] A way to handle AutoHotKey PE
• [ ] A way to handle Delphi like it is done with this ida and associated plugins idr, idc scripts, https://github.com/nccgroup/pythia etc...
• [x] A way to handle VB5/VB6 - fixed by @aaSSfxxx https://github.com/aaSSfxxx/r2_scripts/blob/master/vb_analysis.py
• [ ] Add the VB helper script in Core - https://github.com/radare/radare2/issues/12311

[XVilka]

https://github.com/radare/radare2/commit/5c98293b20fd02288c724ee8b52ae2541f850716 - can be useful for implementing some of those.

[XVilka]

So now the biggest priority of improving Windows support is to fix all broken tests and enable depending on them on AppVeyor: OK 5345 BR 872 XX 1744 FX 0

[XVilka]

@GustavoLCR @pelijah FYI