PE: PDB might be corrupted, results in error
yankovs opened this issue · comments
Hi!
Describe the bug
Some PEs might have garbled/unprintable PDB information, this was noticed in malware. Current LIEF latest release (python) seems to have the assumption that PDB path can be decoded to string, but this result in UnicodeDecodeError.
To Reproduce
Parse these files (malware) with lief, and try to do debug_CodeViewPDB_obj.filename:
4441f70fdcc022973443ad6731d3f4f340194bbbbb0b78eaec9eb4000cf96863
de593f78675c149a84672e8e857c6886e0e448345ee16493fa01458a7c2da876
3103ebb8576654b0f3ef393bb5c860e93fb69ab8400e01295b25b0f244b34c61
Note that in these 3 files VT doesn't display PDB info at all. It's possible they skip PDB that's in an unprintable state, or it's also possible there's an issue with LIEF parsing for these cases and there's no PDB at all.
Expected behavior
For consistency reasons, I would expect this be like the API for section name. Meaning the return type of filename in CodeViewPDB would be str | bytes and bytes are returned upon UnicodeDecodeError. That way, the LIEF user can decide for themselves what to do with such value.
Environment (please complete the following information):
- System and Version: Ubuntu
- Target format: PE
- LIEF commit version: 0.14.1-bae887e0
Hi @yankovs
Thank you for raising this issue. Would you mind to attach one of these samples? (I don't have access to VT)
Hey, thanks for the response!
Sure, here is one of the files. Password is "infected"
15952517082.zip