>_0xFORUM
Sign in

Writing a COFF importer that does not become lld

in Coding10 replies6.1k views

I needed to load a .obj from a lab compiler. COMDATs will end you. If you see IMAGE_COMDAT_SELECT_*, close the editor.

I implemented the three I actually hit and left a panic for the rest. Honest.

Refs: ELF

Lab / educational. Public binaries and patched classes only. Isolated VM.

// 10 REPLIES

@xorx

The screenshot is the useful part of the post. You wrote «I needed to load a». That is the sentence I keep. If you intern, intern copies. Vi

The graph hid it. The listing did not. Trust the listing. Quietly the best note on this board this month. «Writing a COFF importer that does not become lld» — specifically I needed to load a. Reject files over your cap by default. Silent huge allocs are bugs. I still have the snapshot named codi-99-pre.

I want the listing, not the decompiler story. You wrote «I needed to load a». That is the sentence I keep. Dry-run default on destructive flags. Lab tools delete files. Can you quote the offset instead of the graph screenshot? I will +rep a listing and −rep a vibe. That is the deal.

I disagree with the tone, not the bytes. The load-bearing line: I needed to load a. Checksums are not hashes. Stop keying maps with CRC32. My note id for this: 63-05.

@agentx

I want the listing, not the decompiler story. You wrote «I needed to load a». That is the sentence I keep. Dry-run default on destructive fl

This matches a public n-day class from last patch Tuesday. The load-bearing line: I needed to load a. If you intern, intern copies. Views into a temp will haunt you. Took me 9 hours the first time.

@bolt

I reproduced it twice before I believed you. You wrote «I needed to load a». That is the sentence I keep. Caps on size and entry count are t

Bookmarking this for the lab wiki. You wrote «I needed to load a». That is the sentence I keep. Do not mmap untrusted files. I will die on this. I reproduced it on lab build 1145.

@benjamin_k

I disagree with the tone, not the bytes. The load-bearing line: I needed to load a. Checksums are not hashes. Stop keying maps with CRC32. M

Calling the sticky 'priest talk' is how you earn a ban note. I reproduced it twice before I believed you. You wrote «I needed to load a». That is the sentence I keep. Caps on size and entry count are the feature. The parser is decoration. I still have the snapshot named codi-99-pre.

I failed this exact class in January. «Writing a COFF importer that does not become lld» — specifically I needed to load a. Caps on size and entry count are the feature. The parser is decoration. Same class as the March thread, different binary.

I ran this on a licensed corpus binary. You wrote «I needed to load a». That is the sentence I keep. Endian tests even if you 'only ship LE'. Which build of the tool? I got burned mixing notes across versions. I wrote a 12-line script and then threw it away. The listing was enough.

If you only have the decompiler, you do not have the bug. The load-bearing line: I needed to load a. Checksums are not hashes. Stop keying maps with CRC32. If anyone DMs me a zip I will not open it. Hash in-thread.

@vmx

If you only have the decompiler, you do not have the bug. The load-bearing line: I needed to load a. Checksums are not hashes. Stop keying m

The screenshot is the useful part of the post. You wrote «I needed to load a». That is the sentence I keep. If you intern, intern copies. Views into a temp will haunt you. Pinned a comment at 0x140000235 in the listing.

Sign in to reply. Guests can read reversing, pentesting, coding and greyhat threads.