Skip to content

Conversation

@iximeow
Copy link
Contributor

If a .NET assembly has a table large enough to trip a coded index into the larger 4-byte format rather than the 2-byte format, getnetguids.py would get totally thrown for a loop and read guids from somewhat arbitrary places.

is fix nao

Resolves#6

Also helps-with-but-doesn't-quite-solve #4, where there's also some strangeness at play with the #- metadata tables' uncompressed data, rather than the normal #~ compressed metadata.

Andy Wortman added 3 commits June 14, 2016 17:05
Since typelib ids are recorded as a GuidAttribute on an assembly, any guids from other CustomAttribute entries that are not on an assembly and are not constructed from a MemberRef can be discarded. MemberRef can be used to filter because GuidAttribute comes from mscorlib, so unless we're looking at mscorlib itself GuidAttribute will always be constructed using a MemberRef into another assembly.
If higher-index tables were not present, but their row count affects a coded index, the row_count array may not have been large enough to index for all tables the coded index can reach. As a fix, ensure the row_count table is always 64 entries.
@ghost ghost merged commit 3aed213 into cylance:masterJun 15, 2016
@ghost
Copy link

Thanks!

This pull request was closed.
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Inconsistency on file with hash d75d526893b503ab81c6298bab91083a7a9da35adce0709433c10e925592d0c6

1 participant

@iximeow