Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Request to add additional resource type support #52

Open
R3MRUM opened this issue May 18, 2022 · 1 comment
Open

Request to add additional resource type support #52

R3MRUM opened this issue May 18, 2022 · 1 comment

Comments

@R3MRUM
Copy link

R3MRUM commented May 18, 2022

Requesting that you add the ability to parse BMP images stored as entries within the .NET resources.

Sample:
https://www.virustotal.com/gui/file/0a5dc3b6669cf31e8536c59fe1315918eb4ecfd87998445e2eeb8fed64bd2f2c

dnfile properly identified the resource names and types but the data property is NoneType. Attached is the output from the following code:

pe = dnfile.dnPE(filepath)
for r in pe.net.resources:
    if r.name == “20a87df82283.Resources.resources”:
        for entry in r.data.entries:
            print(f”{r.name}: {entry.name} - {type(entry.data)}“)
            print(entry.__dict__)
            print(entry.struct.__dict__)

image

I know that the open-source project dnSpy does an excellent job of parsing this resource type from .NET executables so maybe some of that logic can be ported into this project.

https://github.com/dnSpyEx/dnSpy

https://github.com/dnSpyEx/dnSpy/blob/master/Extensions/dnSpy.BamlDecompiler/Baml/KnownTypes.cs

https://github.com/dnSpy/dnSpy/blob/2b6dcfaf602fb8ca6462b8b6237fdfc0c74ad994/dnSpy/dnSpy.Contracts.DnSpy/Documents/TreeView/Resources/SerializedImageListStreamerUtilities.cs#L45-L63

https://github.com/dnSpy/dnSpy/blob/2b6dcfaf602fb8ca6462b8b6237fdfc0c74ad994/dnSpy/dnSpy.Contracts.DnSpy/Documents/TreeView/Resources/SerializedImageListStreamerUtilities.cs#L73-L98

Could possibly use this code to dramatically increate support for other types at the same time.

@malwarefrank
Copy link
Owner

dnSpyEx is using .NET-specific deserializers, so we would still have to figure out how to implement it in Python. I am looking into System.Drawing.Bitmap, but this may take a while

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants