Skip to content

Commit

Permalink
Review: clarified a length
Browse files Browse the repository at this point in the history
  • Loading branch information
daladim committed Sep 17, 2021
1 parent 23e0d08 commit cc3c367
Showing 1 changed file with 5 additions and 4 deletions.
9 changes: 5 additions & 4 deletions src/read/pe/rich.rs
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,8 @@ use crate::{pe, LittleEndian as LE, ReadRef, U32};
pub struct RichHeaderInfos<'data> {
/// The offset at which the rich header starts
pub start: usize,
/// The length (in bytes) of the rich header
/// The length (in bytes) of the rich header.
/// This includes the payload, but also the 16-byte start sequence and the 8-byte final "Rich" and XOR key
pub length: usize,
/// The data used to mask the rich header.
/// Unless the file has been tampered with, it should be equal to a checksum of the file header
Expand Down Expand Up @@ -62,11 +63,11 @@ impl<'data> RichHeaderInfos<'data> {
Err(()) => return None,
Ok(slice) => slice.len(),
};
let rh_len = dos_and_rich_header.len() - rich_header_start;
let rh_len = dos_and_rich_header.len() - rich_header_start + 8/* for the "Rich" marker and the XOR key */;

// Extract the contents of the rich header
let items_start = rich_header_start + 16;
let items_len = rh_len - 16;
let items_start = rich_header_start + start_sequence.len();
let items_len = rh_len - start_sequence.len() - 8;
let item_count = items_len / std::mem::size_of::<pe::MaskedRichHeaderEntry>();
let items =
match data.read_slice_at::<pe::MaskedRichHeaderEntry>(items_start as u64, item_count) {
Expand Down

0 comments on commit cc3c367

Please sign in to comment.