You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently, the ManagedPEImageBuilder does not preserve any non-conventional metadata streams of the original input binary, nor does it preserve the original order the streams are defined. This can be problematic for processing binaries that are obfuscated and/or depend on these unknown streams / order of streams.
Proposal
Add MetadataBuilderFlags.PreserveUnknownStreams and MetadataBuilderFlags.PreserveStreamOrder.
Alternatives
A workaround for now is to first turn a ModuleDefinition into a PEImage, and then manually add / reorder the streams in the constructed metadata directory. This, however, requires more effort from the end-user and is not always trivial to implement.
Additional Context
Obfuscators like KoiVM like to insert custom metadata streams to the beginning of the list of the metadata directory.
The text was updated successfully, but these errors were encountered:
Problem Description
Currently, the
ManagedPEImageBuilder
does not preserve any non-conventional metadata streams of the original input binary, nor does it preserve the original order the streams are defined. This can be problematic for processing binaries that are obfuscated and/or depend on these unknown streams / order of streams.Proposal
Add
MetadataBuilderFlags.PreserveUnknownStreams
andMetadataBuilderFlags.PreserveStreamOrder
.Alternatives
A workaround for now is to first turn a
ModuleDefinition
into aPEImage
, and then manually add / reorder the streams in the constructed metadata directory. This, however, requires more effort from the end-user and is not always trivial to implement.Additional Context
Obfuscators like KoiVM like to insert custom metadata streams to the beginning of the list of the metadata directory.
The text was updated successfully, but these errors were encountered: