peres does not read shuffled resources about readpe HOT 10 CLOSED

I used PortEx: https://github.com/katjahahn/PortEx/tree/master/src/main/java/com/github/katjahahn/parser/sections/rsrc
However, it seems the resource_shuffled.exe is not in the corkami project anymore, so I cannot confirm that it works with the current version.

from readpe.

This seems a bit tricky. The resources of this file don't seem to be placed in the resources directory, but somewhere else. I don't remember whether the spec allows this, but if it does, I think we can figure this out using a RVA. Will have to invest some time on this though.

from readpe.

Thank you for your fast replies.
Even if the specification does not allow it (I am sure it doesn't), the windows loader does. It does not care about the size given in the data directory table, nor if the resource tree nodes are all in the same section.

from readpe.

Corkami files are in our TODO for a while now. It is a nice set of binaries that don't follow the specs yet run perfectly under Windows loader. Thanks for this, @katjahahn. We'll take some time to fix this, but we'll do that. ;)

from readpe.

I don't see an easy way to identify which directory is in which position since that is defined/guaranteed by their order/index.

We could traverse all directories, but IMAGE_DATA_DIRECTORY gives us only VirtualAddress and Size before we access the VirtualAddress (translated to an offset) to read an specific directory structure.

That would require a brute-force detection, or maybe I'm missing something.

from readpe.

Hum... @katjahahn do you know a tool that can read it correctly? I'd like to see its source code. 🙂

from readpe.

Does this help?
http://pedump.me/401ed03adc85aa46708994cb5dbb7a89/ ?

It looks one could recreate the exe from http://pedump.me/401ed03adc85aa46708994cb5dbb7a89/#hexdump

from readpe.

It should still be available here from this archive. 😉

from readpe.

PortEx does work with that file.

from readpe.

PortEx ignores the directory table size entry all together. It seems like Windows also ignores it for at least resources which isn't too weird as it is sort of redundant. Commenting out the early return in pe_resource_base_ptr makes it work correctly and overall seems to not break anything from what I could tell.

from readpe.