Add check for reproducible build in PE module #1219
+1,446
−2,908
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ITAYC0HEN
approved these changes
Apr 6, 2020
ITAYC0HEN
left a comment
ITAYC0HEN
left a comment
There was a problem hiding this comment.
The changes are looking good. Thank you! :)
very useful
wxsBSD
reviewed
Apr 7, 2020
libyara/modules/pe/pe.c
Outdated
| size_t pdb_path_len; | ||
| char* pdb_path = NULL; | ||
|
|
||
| set_integer(0, pe->object, "is_reproducible_build"); |
Collaborator
There was a problem hiding this comment.
Does it make sense to set this to zero here? What happens if the debug directory entry (or something else we check later on) is corrupt. In this case a user can get an incorrect value (pe.is_reproducible_build would be zero) when it should be UNDEFINED at this point.
Contributor
Author
There was a problem hiding this comment.
Thank you for your suggestion. Now the value is set to 0 only when debug directory is empty or when code successfully iterated through all entries
Handle cases when the is_reproducible_build should be YR_UNDEFINED instead of 0
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Since there is a code that parses debug directory, I thought it's a good idea to add some value that can be used for checking if the PE binary build as "reproducible build". If this value is set, it means that timestamps in the PE can be replaced with some other values to achieve reproducibility.
Here is more information about reproducible builds:
https://devblogs.microsoft.com/oldnewthing/20180103-00/?p=97705
https://docs.microsoft.com/en-us/windows/win32/debug/pe-format?redirectedfrom=MSDN#debug-type