You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I'm trying to use LIEF to parse PE Headers in memory, only supplying the first 0x1000 bytes as the rest of the data is not required.
LIEF does not allow me to only call parse_headers() manually as the function is private, so I tried to use the public LIEF::PE::Parser::parse() function and I noted a bunch of issues here:
LIEF::PE::Parser::parse() only takes a std::vector<uint8_t> data and creates a copy, not by reference like all the other parsers
When parsing a 0x1000 bytes PE header, even when disabling all options in LIEF::PE::ParserConfig it logs many warnings and even an error, although the header was parsed just fine and a valid LIEF::PE::Binary object was returned. The logged error is Can't read the padding content of section '.text' naturally as .text is the first section.
Given these issues I think a nice feature would be allowing to parse only the header and disabling all other parsing by adding more options to LIEF::PE::ParserConfig such that only parse_headers() will be executed. No errors should be printed when a valid object is returned from LIEF::PE::Parser::parse(). Data passed to parse() should never be copied in the first API invocation, only when necessary.
I also think it would be nice to somehow return the internal errorcodes to the user instead of letting the user rely on the logging. The parse() function currently gives absolutely no insight into why the parsing failed. It should probably return ok_error_t containing the binary object.
Thanks a lot for this project!
The text was updated successfully, but these errors were encountered:
I'm trying to use LIEF to parse PE Headers in memory, only supplying the first 0x1000 bytes as the rest of the data is not required.
LIEF does not allow me to only call
parse_headers()
manually as the function is private, so I tried to use the publicLIEF::PE::Parser::parse()
function and I noted a bunch of issues here:std::vector<uint8_t> data
and creates a copy, not by reference like all the other parsersLIEF::PE::ParserConfig
it logs many warnings and even an error, although the header was parsed just fine and a validLIEF::PE::Binary
object was returned. The logged error isCan't read the padding content of section '.text'
naturally as .text is the first section.Given these issues I think a nice feature would be allowing to parse only the header and disabling all other parsing by adding more options to
LIEF::PE::ParserConfig
such that onlyparse_headers()
will be executed. No errors should be printed when a valid object is returned fromLIEF::PE::Parser::parse()
. Data passed toparse()
should never be copied in the first API invocation, only when necessary.I also think it would be nice to somehow return the internal errorcodes to the user instead of letting the user rely on the logging. The
parse()
function currently gives absolutely no insight into why the parsing failed. It should probably returnok_error_t
containing the binary object.Thanks a lot for this project!
The text was updated successfully, but these errors were encountered: