imports/ImHex-Patterns
1
0
Fork 0
mirror of https://github.com/WerWolv/ImHex-Patterns.git synced 2026-03-28 07:47:02 -05:00
Code Issues Packages Projects Releases Wiki Activity
404 Commits 2 Branches 46 Tags
cf1858096000f4ee69ad2bb82fcdfd5ed41661c8
Commit Graph

15 Commits

Author SHA1 Message Date
g4ngli0s
0a631f0c1f patterns/pe: Fix BaseRelocationBlock count inside BaseRelocationTable (#212) 2023-12-28 18:31:53 +01:00
gmestanley
1ea12cd4bd patterns/pe: Bringing over the massively improved version of pe.hexpat (#204) 
* Add files via upload

* Update README.md

Added nes.hexpat to list of hex patterns

* Fix indenting of hex patterns list

Moved nes.hexpat below NE.hexpat

* Update README.md

Fixed indenting of PP pattern file's description being wrong

* Added x-msdownload MIME type to PE description

* Made indenting & code of ips.hexpat better

* Improvements to gb.hexpat

* Urgent fix to ips.hexpat

* Urgent fix to gb.hexpat

* Massive pe.hexpat improvement

* Replaced virtualDifference with relativeVirtualDifference

* Fixing unnecessary pattern_limit
 2023-12-07 16:36:50 +01:00
iTrooz
b6e0557a1d patterns: put author and description inside each pattern (#155) 2023-08-28 12:32:23 +02:00
Jason Shirk
520f9bcb22 patterns/pe: Fix DebugDirectory version field types (#146) 2023-08-04 01:14:49 +02:00
gmestanley
7a9ac44577 patterns/pe: Improved PE pattern (#112) 
New improvement
 2023-05-16 11:03:07 +02:00
Zaggy1024
1cd7f92a5d patterns/includes: Update standard library and patterns to support the new bitfields (#102) 
* Add `current_bit_offset()` and `read_bits(...)` to `std::mem`

* Replace deprecated BitfieldOrder enum values with new clearer names

This adds new options named `MostToLeastSignificant` and `LeastToMostSignificant` to replace the old `LeftToRight` and `RightToLeft` names. These names should be much clearer about what they affect and how.

* Throw errors when `std::core::(get|set)_bitfield_order()` are called

* Update all patterns to work with the new bitfield behaviors
 2023-04-01 11:16:54 +02:00
qux-bbb
2d45d5d086 patterns/pe: Removed unnecessary offset (#87) 
Remove unnecessary offsets
 2023-02-22 21:05:13 +01:00
gmestanley
49be43e0e1 patterns: Making pe.hexpat even better (#52) 
* Update pe.hexpat

Implementing a number of things and fixing others

* Update pe.hexpat

Adding the readonlyData pattern

* Update pe.hexpat

Testing putting the number of tabs on Github to 4 instead of 8 (so that comments on the code for the Sections don't break)

* Update pe.hexpat

Reverting change that turned out to be needless

* Update pe.hexpat

Actually sending the `products[while($ != richHeaderEndPosition)]` to `products[while($ < richHeaderEndPosition)]` change
 2022-10-30 12:07:54 +01:00
Nik
dba93afe06 patterns: Fixed duplicate variable names 2022-09-21 16:34:23 +02:00
Nik
2cfd3c43a7 patterns: Added x-dosexec MIME type to PE pattern 2022-09-13 15:57:34 +02:00
gmestanley
ece86f1124 patterns: Added enhancements for PE pattern (#41) 
The current pattern file for the PE format doesn't have a lot of the format's quirks, so I decided to code them in after I noticed that it doesn't cover the structure known as Rich Header. (Forgive the garbage code for its ProductType enum, it was the only way I found to make the values appear.)
Here are my sources for the improvements included here:

How the MZ header works and some of its variables' names: [How to determine the size of an PE executable file from headers and or footers](https://stackoverflow.com/questions/34684660/how-to-determine-the-size-of-an-pe-executable-file-from-headers-and-or-footers)
The function of some of the MZ header variables: [https://github.com/corkami/pics/blob/master/binary/pe102.png](PE102 by Corkami)
The existence of sections: [https://github.com/corkami/pics/blob/master/binary/pe101/pe101.png](PE101 by Corkami)
The Machine values for LoongArch processors, the architecture enum and how it's used in the Optional Header, Subsystem types, DLL & Section characteristics, how sections, their line numbers and relocations work: [PE Format](https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#the-rsrc-section)
The Machine values for DECAlphaAXP and i860: [Peering Inside the PE: A Tour of the Win32 Portable Executable File Format](https://docs.microsoft.com/en-us/previous-versions/ms809762(v=msdn.10)#the-pe-header)
How the Rich Header works: [https://www.virusbulletin.com/virusbulletin/2020/01/vb2019-paper-rich-headers-leveraging-mysterious-artifact-pe-format/](VB2019 paper: Rich Headers: leveraging this mysterious artifact of the PE format)
Values of products in the Rich Header: [https://securelist.com/the-devils-in-the-rich-header/84348/](The devil’s in the Rich header)
Every other value not found in the above source: Ghidra
 2022-08-10 15:06:10 +02:00
Oded Shapira
65f2b7821b patterns: Fix typo in pe.hexpat (#39) 
Fixed a typo where it said numberOfRelactions to numberOfRelocations.
 2022-08-04 23:49:26 +02:00
WerWolv
7c3db44abc patterns: Fix removal of nextAfter builtin function 2021-05-22 00:03:05 +02:00
ThisALV
2f41f6e233 Improved PE patterns for both x86 and x64 files. (#9) 
* Improved PE patterns for both x86 and x64 files.

Added sections table and data directories.
Support for 64bits binaries.
Separated files for 32bits and 64bits binaries.

* Deleted old PE pattern.

* Single file used for both PE32 and PE32+.

Change FORMAT preprocessor constant to switch mode.

* Improved sections table localization.

Using recently added nextAfter() builtin-function to locate sections
table.

* Automatic detection for 64bits executables.

Automatically detect if PE32+ format is enabled by checking machine
value.

* Updated README.md for single PE hexpat file.

* Use String for sections name.

* Remove silly usage of define preprocessor.
 2021-01-24 14:31:51 +01:00
WerWolv
f2d85fd506 Uploaded currently available files 2020-12-03 21:49:54 +01:00