META - Portable Executable

[Maijin]

All Portable Executables

Related

• Doc - TBD
• Tests - https://github.com/radare/radare2-regressions/tree/master/t.formats/pe
• Commands involved - N/A
• BlogPost - TBD
• .c involved:
  • https://github.com/radare/radare2/blob/master/libr/bin/p/bin_pe.c

General Information

• Add DLL Characteristics in iI, iIj (Already parsed in SDB) Providing platform specific information with rabin2 #6785 Or in iH , iHj Implement rabin2 -H (r2 -ciH) for more fileformats #6759
• VTABLE detection for MSVC https://github.com/radare/radare2/issues/6851
• Add authentihash and authentihash check in it and itj

R_BIN Enhancement

radare2-regressions files that are not properly parsed by r2 currently:

• d_resource.dll
• d_tiny.dll
• dosZMXP.exe
• exe2pe.exe
• no0code.exe

Analysis

• detect and rename the elements/structures accordingly. (See all the +ms_exc.registration.TryLevel etc...) see http://pastebin.com/aLrkiwuM
  reversing-demo.zip

Resources

• Add/remove/modify/dump Resources rabin2 -O && iO

Import/Export Table

• Ability to move the import table rabin2 -O && iO
• Ability to add/remove import/export library (with prior checks to see if possible) rabin2 -O && iO
• Ability to add/remove function to a library (with prior checks to see if possible) rabin2 -O && iO
• Ability to dump a process and reconstruct/manipulate IAT (ollydump + IMPrec tool / x64dbg) (https://github.com/OALabs/PyIATRebuild/blob/master/pyiatrebuild.py)
• Add PE unmapper https://github.com/hasherezade/malware_analysis/tree/master/pe_unmapper {as a r2e module}
• Implement the Windows API import recovery functionality shown in the apiscout: https://github.com/danielplohmann/apiscout -- (API import recovery: http://byte-atlas.blogspot.de/2017/04/apiscout.html) (Please port to radare2 danielplohmann/apiscout#1)
• Add imphash https://github.com/Neo23x0/ImpHash-Generator {As a r2e module}

Rich Header

• Parse Rich header #12889

Debug Informations

• Display debug file info: age

Sections

• Add sections headers into the pf output
• Ability to add/resize/move/... sections

SEH/VEH

• SEH Parser for PE 32 bits see http://blog.davidegrayson.com/2016/02/windows-32-bit-structured-exception.html
• SEH Parser for PE 64bits see https://github.com/tandasat/scripts_for_RE/blob/master/parse_x64_SEH.py

Specific Language Portable Executables

.NET

• Load and display .NET PE information in iI,iIj
• http://www.ntcore.com/files/dotnetformat.htm
• http://www.reddit.com/r/ReverseEngineering/comments/2cw2o2/pe_net_that_is_not_pe_net/
• https://blog.cylance.com/you-me-and-.net-guids
  See preliminary step - .NET support in R2 #6771

Others

• A way to handle RFG
• A way to handle AutoIT PE
• A way to handle AutoHotKey PE
• A way to handle Delphi like it is done with this ida and associated plugins idr, idc scripts, https://github.com/nccgroup/pythia etc...
• A way to handle VB5/VB6 - fixed by @aaSSfxxx https://github.com/aaSSfxxx/r2_scripts/blob/master/vb_analysis.py
• Add the VB helper script in Core - Add VB helpers in core  #12311

[XVilka]

5c98293 - can be useful for implementing some of those.

[XVilka]

So now the biggest priority of improving Windows support is to fix all broken tests and enable depending on them on AppVeyor: OK 5345 BR 872 XX 1744 FX 0

[XVilka]

@GustavoLCR @pelijah FYI