Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

extract ordinal and name imports #343

Merged
merged 2 commits into from
Oct 22, 2020
Merged

Conversation

mr-tz
Copy link
Collaborator

@mr-tz mr-tz commented Oct 20, 2020

if name and ordinal are present provide both of these import features

@williballenthin
Copy link
Collaborator

since your example comes from mimikatz, would you add a test for this?

then we can be sure viv also handles this correctly

@mr-tz
Copy link
Collaborator Author

mr-tz commented Oct 20, 2020

vivisect only knows of the import by ordinal: file: 0x004731d0: import(cabinet.#11)

I think it knows some of the network APIs, will look for a test case there.

@mr-tz
Copy link
Collaborator Author

mr-tz commented Oct 20, 2020

It doesn't appear that vivisect makes both import by ordinal and name available. Should we remove the IDA feature or accept the discrepancy?

@williballenthin
Copy link
Collaborator

i'd say we should accept the discrepancy. i'd lean on the side of having more info when possible. i see this as an issue with viv.

@mr-tz
Copy link
Collaborator Author

mr-tz commented Oct 21, 2020

Thanks, I've added an IDA specific test for this (see last row in image below).

2020-10-21_12-24-53

All tests pass.

@mr-tz mr-tz merged commit 8bb3050 into master Oct 22, 2020
@mr-tz mr-tz deleted the fix/file-imports-ordinal-name branch October 22, 2020 18:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants