Skip to content

Commit

Permalink
updated fixes in identify.py
Browse files Browse the repository at this point in the history
  • Loading branch information
sara-rn committed Nov 14, 2023
1 parent 605a7b4 commit 86d8b34
Show file tree
Hide file tree
Showing 2 changed files with 13 additions and 20 deletions.
27 changes: 13 additions & 14 deletions floss/language/identify.py
Original file line number Diff line number Diff line change
Expand Up @@ -101,20 +101,19 @@ def get_if_go_and_version(pe: pefile.PE) -> Tuple[bool, str]:
b"runtime.Gosched",
]
# look for the .rdata section first
for section in pe.sections:
try:
section_name = section.Name.partition(b"\x00")[0].decode("utf-8")
except UnicodeDecodeError:
continue
if ".rdata" == section_name:
section_va = section.VirtualAddress
section_size = section.SizeOfRawData
section_data = section.get_data(section_va, section_size)
for magic in go_magic:
if magic in section_data:
pclntab_va = section_data.index(magic) + section_va
if verify_pclntab(section, pclntab_va):
return True, get_go_version(magic)
try:
section = get_rdata_section(pe)
section_va = section.VirtualAddress
section_size = section.SizeOfRawData
section_data = section.get_data(section_va, section_size)
for magic in go_magic:
if magic in section_data:
pclntab_va = section_data.index(magic) + section_va
if verify_pclntab(section, pclntab_va):
return True, get_go_version(magic)
except ValueError:
logger.debug(".rdata section not found")


# if not found, search in all the available sections
for magic in go_magic:
Expand Down
6 changes: 0 additions & 6 deletions floss/language/rust/extract.py
Original file line number Diff line number Diff line change
Expand Up @@ -17,12 +17,6 @@
MIN_STR_LEN = 4


def get_rdata_section(pe: pefile.PE) -> pefile.SectionStructure:
for section in pe.sections:
if section.Name.startswith(b".rdata\x00"):
return section

raise ValueError("no .rdata section found")


def fix_b2s_wide_strings(
Expand Down

0 comments on commit 86d8b34

Please sign in to comment.