Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Address several issues with reading specially crafted .NET metadata #557

Merged

Conversation

ElektroKill
Copy link
Contributor

This PR fixes a couple of issues with reading specially crafted files that abuse implementation quirks of the CLR metadata reader.

The following quirks were addressed (sample files can be found in the PR):

  • The presence of the #Schema stream forces the parsing of metadata as if it was EnC metadata even if the tablees stream name suggests compressed metadata.
  • When reading EnC metadata, the CLR performs a case insensitive comparison when looking for stream names#Blob, #US, #Strings, #GUID as compared to byte for byte compare when reading compressed metadata.
  • When reading EnC metadata, the CLR checks for the presence of a stream named #JTD and if it found it forces all column index sizes to 4 bytes.

All the above-mentioned quirks were addressed in the PR and have accompanying tests.

@Washi1337 Washi1337 added bug pe Issues related to AsmResolver.PE labels May 19, 2024
@Washi1337 Washi1337 added this to the 6.0.0 milestone May 19, 2024
@Washi1337 Washi1337 merged commit 24461bf into Washi1337:development May 30, 2024
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug pe Issues related to AsmResolver.PE
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants