Wesley Shields 6d40a34260 Fix Rich header parsing. (#1164) ...

* Fix Rich header parsing.

The rich header doesn't always start at 0x80. The proper way to find the rich
header is to start at the NT header and work backwards one dword at a time
(technically the NT header is supposed to be 8 byte aligned, if someone has a
sample which isn't I'd love to see it) looking for Rich. Once you find it you
can get the XOR key which follows it and then continue to look backwards for
the DanS (after applying the XOR).

Decent documentation on this is at
http://bytepointer.com/articles/the_microsoft_rich_header.htm.

Also, fun fact which we may want to consider implementing is that the XOR key is
actually derived from the DOS header, so it may be an interesting way to tell if
the rich header has been tampered with if they do not properly recalculate the
key.

Fixes #1149.

* Split Rich signature walking into two loops.

While here, add a test that makes sure the clear version of the rich signature
is properly calculated.

2019-11-15 10:56:07 +01:00

840 B

Raw History

View Raw