Changeset 1148

Timestamp:

03/20/07 22:41:23 (2 years ago)

Author:

till

Message:

some robustness...

Files:

• pehunter/README (modified) (1 diff)
• pehunter/pehunter.c (modified) (2 diffs)
• pehunter/pehunter.h (modified) (1 diff)

pehunter/README

@@ -1 @@
-
-
-
+
+
-
-It first spots a PE header and then uses a simple heuristik to calculate the
-position of the header
+header offset in a stream
-bytes is then dumped to a file.
-

pehunter/pehunter.c

@@ -196 +196 @@
-
-        /* Spot DOS header */
-(session_data->len - parsedBytes) < sizeof(IMAGE_DOS_HEADER
+session_data->len < (sizeof(IMAGE_DOS_HEADER) + parsedBytes
-        dosHeader = (IMAGE_DOS_HEADER *)(session_data->data + parsedBytes);
-        if (dosHeader->e_magic != IMAGE_DOS_SIGNATURE) return(0);
@@ -202 +202 @@
-        if (_pehunterConfig.debug) _dpd.logMsg("DOS header found at offset %lu.\n", pos);
-
-(session_data->len - parsedBytes - dosHeader->e_lfanew) < sizeof(IMAGE_NT_HEADERS32
+session_data->len < (sizeof(IMAGE_NT_HEADERS32) + parsedBytes + dosHeader->e_lfanew
-        parsedBytes += dosHeader->e_lfanew;
+        if (_pehunterConfig.debug) _dpd.logMsg("DOS header e_lfanew is %lu, parsedBytes is %lu.\n", dosHeader->e_lfanew, parsedBytes);
-
-        /* image file header */
+        if ((session_data->len) < (sizeof(IMAGE_NT_HEADERS32) + parsedBytes)) return(0);
-        peHeader = (IMAGE_NT_HEADERS32*)(session_data->data + parsedBytes);
-        if (peHeader->Signature == IMAGE_NT_SIGNATURE)
-        {
-                if (_pehunterConfig.debug) _dpd.logMsg("NT header found at offset %lu.\n", parsedBytes);
-                if ((session_data->len - parsedBytes) < sizeof(IMAGE_NT_HEADERS32)) return(0);
-                parsedBytes += sizeof(IMAGE_NT_HEADERS32);
-
-
-                /* loop through section table */
-                for (i=0; i<peHeader->FileHeader.NumberOfSections; i++) {
-(session_data->len - parsedBytes) < sizeof(IMAGE_SECTION_HEADER
+session_data->len < (sizeof(IMAGE_SECTION_HEADER) + parsedBytes
-                        sectHeader = (IMAGE_SECTION_HEADER *)(session_data->data + parsedBytes);
+                        if (_pehunterConfig.debug) _dpd.logMsg("Section header found at offset %lu.\n", parsedBytes);
-                        parsedBytes += sizeof(IMAGE_SECTION_HEADER);
-u: starts at offset %
-
+lu (%s): starts at offset %l
+Name, sectHeader->
-                        if (maxOffset < sectHeader->PointerToRawData) {
-                                maxOffset       = sectHeader->PointerToRawData;

pehunter/pehunter.h

@@ -37 +37 @@
-
-typedef struct _IMAGE_SECTION_HEADER {
-u_int8_t
+char
-        union {
-                u_int32_t       PhysicalAddress;