libextractor

pecoff_extractor.c (63612B)

---

 /*
      This file is part of libextractor.
      Copyright (C) 2026 Vidyut Samanta and Christian Grothoff
 
      libextractor is free software; you can redistribute it and/or modify
      it under the terms of the GNU General Public License as published
      by the Free Software Foundation; either version 3, or (at your
      option) any later version.
 
      libextractor is distributed in the hope that it will be useful, but
      WITHOUT ANY WARRANTY; without even the implied warranty of
      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
      General Public License for more details.
 
      You should have received a copy of the GNU General Public License
      along with libextractor; see the file COPYING.  If not, write to the
      Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
      Boston, MA 02110-1301, USA.
  */
 /**
  * @file plugins/pecoff_extractor.c
  * @brief plugin to support Windows PE/COFF images (.exe, .dll, .sys)
  * @author Christian Grothoff
  *
  * What makes a PE worth looking at in a forensic pass is not the code
  * but the residue the build left behind: the Rich header records every
  * tool that touched the object files, the CodeView record names the
  * directory the developer built in, the import table fingerprints what
  * the binary can do, and the version resource carries the vendor's own
  * claim about what it is.  All of that lives in a handful of small
  * structures, so this plugin reads headers and directories only and
  * never walks the code.
  *
  * References:
  *   "PE Format", https://learn.microsoft.com/windows/win32/debug/pe-format
  *   "Windows Authenticode Portable Executable Signature Format"
  *   Rich header: no vendor documentation exists; the layout used here is
  *   the one every published analysis agrees on (DanS ... Rich, all
  *   dwords between the two masked with the key that follows `Rich').
  */
 #include "platform.h"
 #include "extractor.h"
 #include "forensics.h"
 
 
 /**
  * Most sections we will look at.  The field is 16 bits wide, but a
  * real image has a few dozen at most and the table has to fit in
  * SizeOfHeaders.
  */
 #define PE_MAX_SECTIONS 96
 
 /**
  * Largest DOS stub we will search for a Rich header.  The stub is
  * 64 bytes plus the Rich header itself in every real image.
  */
 #define PE_MAX_DOS_STUB 4096
 
 /**
  * Most Rich header records we will report.
  */
 #define PE_MAX_RICH_ENTRIES 32
 
 /**
  * Most imported modules we will look at.
  */
 #define PE_MAX_IMPORT_DLLS 64
 
 /**
  * Most imported functions we will fold into the import hash.  Beyond
  * this the hash would not match what other tools compute, so we drop
  * it rather than report a value that cannot be compared.
  */
 #define PE_MAX_IMPORT_FUNCS 8192
 
 /**
  * How much of the section holding the import directory we map in one
  * read.  The descriptors, the lookup tables and the hint/name table
  * are laid out next to each other by every linker, so one read
  * normally resolves the whole import table.
  */
 #define PE_IMPORT_WINDOW (512 * 1024)
 
 /**
  * How much of the resource directory tree we read.  The tree sits at
  * the front of the section; the leaves point elsewhere and are read
  * separately.
  */
 #define PE_MAX_RESOURCE_DIR (64 * 1024)
 
 /**
  * Largest VS_VERSIONINFO resource we will parse.
  */
 #define PE_MAX_VERSION_RESOURCE (32 * 1024)
 
 /**
  * How many bytes of a section we hash to estimate its entropy.  16 KiB
  * is far more than enough to tell packed data from code.
  */
 #define PE_ENTROPY_SAMPLE (16 * 1024)
 
 /**
  * How many sections we sample for entropy.
  */
 #define PE_MAX_ENTROPY_SECTIONS 8
 
 /**
  * Smallest section we bother computing entropy for.  Below this the
  * estimate is dominated by the sample size.
  */
 #define PE_MIN_ENTROPY_SECTION 512
 
 /**
  * How much of the certificate table we scan for subject names.
  */
 #define PE_MAX_CERT_SCAN (16 * 1024)
 
 /**
  * Longest single name (module, function, section) we accept.
  */
 #define PE_MAX_NAME 256
 
 
 /**
  * One entry of the section table, in the only four fields we need.
  */
 struct pe_section
 {
   /**
    * Address of the section in the loaded image, relative to the image
    * base.
    */
   uint32_t vaddr;
 
   /**
    * Size of the section in the loaded image.
    */
   uint32_t vsize;
 
   /**
    * Offset of the section data in the file.
    */
   uint32_t raw_ptr;
 
   /**
    * Number of bytes of section data in the file.
    */
   uint32_t raw_size;
 
   /**
    * Section name, NUL-terminated.
    */
   char name[9];
 };
 
 
 /**
  * Everything the individual directory parsers need to know about the
  * image.
  */
 struct pe_context
 {
   /**
    * Extraction context we were called with.
    */
   struct EXTRACTOR_ExtractContext *ec;
 
   /**
    * Size of the file, or 0 if it could not be determined.
    */
   uint64_t fsize;
 
   /**
    * Section table.
    */
   struct pe_section sections[PE_MAX_SECTIONS];
 
   /**
    * Number of valid entries in @e sections.
    */
   unsigned int num_sections;
 
   /**
    * Number of bytes the headers occupy; an RVA below this maps to the
    * same file offset.
    */
   uint32_t size_of_headers;
 
   /**
    * True if this is a PE32+ image, in which case the import lookup
    * table holds 64-bit entries.
    */
   int pe32plus;
 };
 
 
 /* ------------------------------------------------------------------ */
 /* MD5, for the import hash                                            */
 /* ------------------------------------------------------------------ */
 
 /*
  * The import hash is only useful if it equals what every other tool
  * computes for the same file, which pins it to MD5.  libextractor does
  * not link a crypto library and pulling one in for 60 lines of
  * arithmetic would be a poor trade, so RFC 1321 is implemented here.
  * It is never used for anything security relevant.
  */
 
 /**
  * Running MD5 state.
  */
 struct md5_context
 {
   /**
    * Chaining value.
    */
   uint32_t state[4];
 
   /**
    * Number of bytes fed in so far.
    */
   uint64_t count;
 
   /**
    * Partial block not yet compressed.
    */
   unsigned char block[64];
 
   /**
    * Number of bytes used in @e block.
    */
   size_t used;
 };
 
 
 /**
  * The per-round additive constants, floor(2^32 * |sin(i + 1)|).
  */
 static const uint32_t md5_k[64] = {
   0xd76aa478U, 0xe8c7b756U, 0x242070dbU, 0xc1bdceeeU,
   0xf57c0fafU, 0x4787c62aU, 0xa8304613U, 0xfd469501U,
   0x698098d8U, 0x8b44f7afU, 0xffff5bb1U, 0x895cd7beU,
   0x6b901122U, 0xfd987193U, 0xa679438eU, 0x49b40821U,
   0xf61e2562U, 0xc040b340U, 0x265e5a51U, 0xe9b6c7aaU,
   0xd62f105dU, 0x02441453U, 0xd8a1e681U, 0xe7d3fbc8U,
   0x21e1cde6U, 0xc33707d6U, 0xf4d50d87U, 0x455a14edU,
   0xa9e3e905U, 0xfcefa3f8U, 0x676f02d9U, 0x8d2a4c8aU,
   0xfffa3942U, 0x8771f681U, 0x6d9d6122U, 0xfde5380cU,
   0xa4beea44U, 0x4bdecfa9U, 0xf6bb4b60U, 0xbebfbc70U,
   0x289b7ec6U, 0xeaa127faU, 0xd4ef3085U, 0x04881d05U,
   0xd9d4d039U, 0xe6db99e5U, 0x1fa27cf8U, 0xc4ac5665U,
   0xf4292244U, 0x432aff97U, 0xab9423a7U, 0xfc93a039U,
   0x655b59c3U, 0x8f0ccc92U, 0xffeff47dU, 0x85845dd1U,
   0x6fa87e4fU, 0xfe2ce6e0U, 0xa3014314U, 0x4e0811a1U,
   0xf7537e82U, 0xbd3af235U, 0x2ad7d2bbU, 0xeb86d391U
 };
 
 
 /**
  * The per-round rotation amounts.
  */
 static const unsigned char md5_r[64] = {
   7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22,
   5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20,
   4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23,
   6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21
 };
 
 
 /**
  * Rotate @a v left by @a n bits.
  *
  * @param v value to rotate
  * @param n number of bits, 1 to 31
  * @return the rotated value
  */
 static uint32_t
 md5_rotl (uint32_t v,
           unsigned int n)
 {
   return (v << n) | (v >> (32 - n));
 }
 
 
 /**
  * Compress one 64-byte block into @a ctx.
  *
  * @param[in,out] ctx hash state
  * @param p the block
  */
 static void
 md5_compress (struct md5_context *ctx,
               const unsigned char *p)
 {
   uint32_t m[16];
   uint32_t a = ctx->state[0];
   uint32_t b = ctx->state[1];
   uint32_t c = ctx->state[2];
   uint32_t d = ctx->state[3];
 
   for (unsigned int i = 0; i < 16; i++)
     m[i] = EXTRACTOR_forensic_le32_ (&p[4 * i]);
   for (unsigned int i = 0; i < 64; i++)
   {
     uint32_t f;
     unsigned int g;
     uint32_t tmp;
 
     if (i < 16)
     {
       f = (b & c) | ((~b) & d);
       g = i;
     }
     else if (i < 32)
     {
       f = (d & b) | ((~d) & c);
       g = (5 * i + 1) % 16;
     }
     else if (i < 48)
     {
       f = b ^ c ^ d;
       g = (3 * i + 5) % 16;
     }
     else
     {
       f = c ^ (b | (~d));
       g = (7 * i) % 16;
     }
     tmp = d;
     d = c;
     c = b;
     b = b + md5_rotl (a + f + md5_k[i] + m[g],
                       md5_r[i]);
     a = tmp;
   }
   ctx->state[0] += a;
   ctx->state[1] += b;
   ctx->state[2] += c;
   ctx->state[3] += d;
 }
 
 
 /**
  * Start a new MD5 computation.
  *
  * @param[out] ctx hash state to initialise
  */
 static void
 md5_init (struct md5_context *ctx)
 {
   ctx->state[0] = 0x67452301U;
   ctx->state[1] = 0xefcdab89U;
   ctx->state[2] = 0x98badcfeU;
   ctx->state[3] = 0x10325476U;
   ctx->count = 0;
   ctx->used = 0;
 }
 
 
 /**
  * Feed @a len bytes into the hash.
  *
  * @param[in,out] ctx hash state
  * @param data the bytes
  * @param len number of bytes in @a data
  */
 static void
 md5_update (struct md5_context *ctx,
             const void *data,
             size_t len)
 {
   const unsigned char *p = data;
 
   ctx->count += len;
   while (0 != len)
   {
     size_t take = sizeof (ctx->block) - ctx->used;
 
     if (take > len)
       take = len;
     memcpy (&ctx->block[ctx->used],
             p,
             take);
     ctx->used += take;
     p += take;
     len -= take;
     if (sizeof (ctx->block) == ctx->used)
     {
       md5_compress (ctx,
                     ctx->block);
       ctx->used = 0;
     }
   }
 }
 
 
 /**
  * Finish the hash and write the 16-byte digest.
  *
  * @param[in,out] ctx hash state
  * @param[out] digest where to store the result
  */
 static void
 md5_final (struct md5_context *ctx,
            unsigned char *digest)
 {
   uint64_t bits = ctx->count * 8;
   unsigned char tail[8];
   static const unsigned char pad = 0x80;
   static const unsigned char zero = 0x00;
 
   for (unsigned int i = 0; i < 8; i++)
     tail[i] = (unsigned char) ((bits >> (8 * i)) & 0xFF);
   md5_update (ctx,
               &pad,
               1);
   while (56 != ctx->used)
     md5_update (ctx,
                 &zero,
                 1);
   /* md5_update() has bumped ctx->count past the real length, but the
      length we are about to append was captured before the padding. */
   md5_update (ctx,
               tail,
               8);
   for (unsigned int i = 0; i < 4; i++)
     for (unsigned int j = 0; j < 4; j++)
       digest[4 * i + j] = (unsigned char) ((ctx->state[i] >> (8 * j)) & 0xFF);
 }
 
 
 /* ------------------------------------------------------------------ */
 /* address translation                                                 */
 /* ------------------------------------------------------------------ */
 
 
 /**
  * Translate a relative virtual address into a file offset.
  *
  * Every directory in a PE is addressed by RVA, so this is the one
  * place where a forged section table turns into an out-of-range read.
  * The result is checked against the file size and the amount of data
  * the section actually has in the file.
  *
  * @param ctx image being parsed
  * @param rva address relative to the image base
  * @param[out] offset where to store the file offset
  * @param[out] avail where to store how many bytes are readable there
  * @return 1 on success, 0 if @a rva is not backed by file data
  */
 static int
 pe_rva_to_offset (const struct pe_context *ctx,
                   uint32_t rva,
                   uint64_t *offset,
                   uint64_t *avail)
 {
   for (unsigned int i = 0; i < ctx->num_sections; i++)
   {
     const struct pe_section *s = &ctx->sections[i];
     uint32_t span = s->vsize;
     uint32_t delta;
 
     if (span < s->raw_size)
       span = s->raw_size;   /* the loader maps whatever is in the file */
     if (0 == span)
       continue;
     if ( (rva < s->vaddr) ||
          (rva - s->vaddr >= span) )
       continue;
     delta = rva - s->vaddr;
     if (delta >= s->raw_size)
       return 0;   /* in the BSS part of the section; nothing in the file */
     if (((uint64_t) s->raw_ptr) + delta >= ctx->fsize)
       return 0;
     *offset = ((uint64_t) s->raw_ptr) + delta;
     *avail = s->raw_size - delta;
     if (*avail > ctx->fsize - *offset)
       *avail = ctx->fsize - *offset;
     return 1;
   }
   /* Addresses below SizeOfHeaders are mapped one-to-one; a few linkers
      put small directories there. */
   if ( (0 != ctx->size_of_headers) &&
        (rva < ctx->size_of_headers) &&
        (rva < ctx->fsize) )
   {
     *offset = rva;
     *avail = ctx->size_of_headers - rva;
     if (*avail > ctx->fsize - *offset)
       *avail = ctx->fsize - *offset;
     return 1;
   }
   return 0;
 }
 
 
 /**
  * Read @a len bytes from the address @a rva.
  *
  * @param ctx image being parsed
  * @param rva address relative to the image base
  * @param[out] buf where to store the data
  * @param len number of bytes to read
  * @return 1 on success, 0 if the address is not backed by that much
  *         file data
  */
 static int
 pe_read_rva (struct pe_context *ctx,
              uint32_t rva,
              void *buf,
              size_t len)
 {
   uint64_t off;
   uint64_t avail;
 
   if (! pe_rva_to_offset (ctx,
                           rva,
                           &off,
                           &avail))
     return 0;
   if (avail < len)
     return 0;
   return EXTRACTOR_forensic_read_ (ctx->ec,
                                    (int64_t) off,
                                    buf,
                                    len);
 }
 
 
 /* ------------------------------------------------------------------ */
 /* small formatting helpers                                            */
 /* ------------------------------------------------------------------ */
 
 
 /**
  * Append @a what to the comma-separated list in @a buf.
  *
  * @param buf destination buffer
  * @param size number of bytes in @a buf
  * @param what text to append
  */
 static void
 pe_append (char *buf,
            size_t size,
            const char *what)
 {
   size_t used = strlen (buf);
   size_t need = strlen (what);
 
   if (0 != used)
   {
     if (used + 2 >= size)
       return;
     buf[used++] = ',';
     buf[used++] = ' ';
     buf[used] = '\0';
   }
   if (used + need + 1 > size)
     return;
   memcpy (&buf[used],
           what,
           need + 1);
 }
 
 
 /**
  * Name of a COFF machine type.
  *
  * @param machine the raw field
  * @return a static string, NULL if the value is not one we know
  */
 static const char *
 pe_machine_name (uint16_t machine)
 {
   switch (machine)
   {
   case 0x014c:
     return "i386";
   case 0x0162:
     return "MIPS R3000";
   case 0x0166:
     return "MIPS little-endian";
   case 0x0169:
     return "MIPS WCE v2";
   case 0x01a2:
     return "Hitachi SH3";
   case 0x01a3:
     return "Hitachi SH3 DSP";
   case 0x01a6:
     return "Hitachi SH4";
   case 0x01a8:
     return "Hitachi SH5";
   case 0x01c0:
     return "ARM";
   case 0x01c2:
     return "ARM Thumb";
   case 0x01c4:
     return "ARM Thumb-2";
   case 0x01d3:
     return "Matsushita AM33";
   case 0x01f0:
     return "PowerPC";
   case 0x01f1:
     return "PowerPC with FPU";
   case 0x0200:
     return "Itanium";
   case 0x0266:
     return "MIPS16";
   case 0x0284:
     return "Alpha 64";
   case 0x0366:
     return "MIPS with FPU";
   case 0x0466:
     return "MIPS16 with FPU";
   case 0x0ebc:
     return "EFI byte code";
   case 0x5032:
     return "RISC-V 32";
   case 0x5064:
     return "RISC-V 64";
   case 0x5128:
     return "RISC-V 128";
   case 0x6232:
     return "LoongArch 32";
   case 0x6264:
     return "LoongArch 64";
   case 0x8664:
     return "x86-64";
   case 0x9041:
     return "Mitsubishi M32R";
   case 0xaa64:
     return "ARM64";
   case 0xa641:
     return "ARM64EC";
   case 0xa64e:
     return "ARM64X";
   default:
     return NULL;
   }
 }
 
 
 /**
  * Name of a Windows subsystem.
  *
  * @param subsystem the raw field
  * @return a static string, NULL if the value is not one we know
  */
 static const char *
 pe_subsystem_name (uint16_t subsystem)
 {
   switch (subsystem)
   {
   case 1:
     return "native";
   case 2:
     return "Windows GUI";
   case 3:
     return "Windows console";
   case 5:
     return "OS/2 console";
   case 7:
     return "POSIX console";
   case 8:
     return "native Windows 9x driver";
   case 9:
     return "Windows CE GUI";
   case 10:
     return "EFI application";
   case 11:
     return "EFI boot service driver";
   case 12:
     return "EFI runtime driver";
   case 13:
     return "EFI ROM";
   case 14:
     return "Xbox";
   case 16:
     return "Windows boot application";
   default:
     return NULL;
   }
 }
 
 
 /* ------------------------------------------------------------------ */
 /* Rich header                                                         */
 /* ------------------------------------------------------------------ */
 
 
 /**
  * Decode the Rich header sitting between the DOS stub and the PE
  * signature.
  *
  * Microsoft's linker records one (product id, build number, use count)
  * triple for every tool that contributed to the image, masks the whole
  * run with a checksum and terminates it with the literal `Rich' plus
  * that mask.  Nothing but MSVC writes it, and the build numbers pin
  * down the exact toolchain installation, which is why it is the
  * standard clustering feature for related binaries.
  *
  * @param ec extraction context
  * @param stub bytes between the end of the DOS header and the PE header
  * @param len number of bytes in @a stub
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 pe_parse_rich (struct EXTRACTOR_ExtractContext *ec,
                const unsigned char *stub,
                size_t len)
 {
   size_t rich = 0;
   size_t dans = 0;
   uint32_t key = 0;
   int found = 0;
   unsigned int tries = 0;
 
   if (len < 16)
     return 0;
   for (size_t i = 0; (i + 8 <= len) && (tries < 8); i++)
   {
     size_t p;
 
     if ( ('R' != stub[i]) ||
          ('i' != stub[i + 1]) ||
          ('c' != stub[i + 2]) ||
          ('h' != stub[i + 3]) )
       continue;
     tries++;
     key = EXTRACTOR_forensic_le32_ (&stub[i + 4]);
     p = i;
     while (p >= 4)
     {
       p -= 4;
       if (0x536E6144U == (EXTRACTOR_forensic_le32_ (&stub[p]) ^ key))
       {
         rich = i;
         dans = p;
         found = 1;
         break;
       }
     }
     if (found)
       break;
   }
   if (! found)
     return 0;
   if (0 !=
       EXTRACTOR_forensic_emit_ (ec,
                                 "pecoff",
                                 EXTRACTOR_METATYPE_BUILD_ID,
                                 "rich:%08x",
                                 (unsigned int) key))
     return 1;
   /* DanS is followed by three masked zero dwords, then the triples. */
   for (size_t q = dans + 16, n = 0;
        (q + 8 <= rich) && (n < PE_MAX_RICH_ENTRIES);
        q += 8, n++)
   {
     uint32_t comp = EXTRACTOR_forensic_le32_ (&stub[q]) ^ key;
     uint32_t uses = EXTRACTOR_forensic_le32_ (&stub[q + 4]) ^ key;
 
     if ( (0 == comp) &&
          (0 == uses) )
       continue;
     if (0 !=
         EXTRACTOR_forensic_emit_ (ec,
                                   "pecoff",
                                   EXTRACTOR_METATYPE_TOOLCHAIN,
                                   "Rich: prodID 0x%04x, build %u, count %u",
                                   (unsigned int) (comp >> 16),
                                   (unsigned int) (comp & 0xFFFF),
                                   (unsigned int) uses))
       return 1;
   }
   return 0;
 }
 
 
 /* ------------------------------------------------------------------ */
 /* debug directory                                                     */
 /* ------------------------------------------------------------------ */
 
 
 /**
  * Report the CodeView record a debug directory entry points at.
  *
  * The RSDS record carries the absolute path of the PDB as it existed
  * on the build machine, which routinely leaks the developer's user
  * name and source tree layout, plus the GUID and age that identify the
  * build on a symbol server.
  *
  * @param ctx image being parsed
  * @param rva address of the record
  * @param size number of bytes in the record
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 pe_parse_codeview (struct pe_context *ctx,
                    uint32_t rva,
                    uint32_t size)
 {
   unsigned char buf[PE_MAX_NAME + 32];
   size_t want = size;
 
   if (size < 24)
     return 0;
   if (want > sizeof (buf))
     want = sizeof (buf);
   if (! pe_read_rva (ctx,
                      rva,
                      buf,
                      want))
     return 0;
   if ( ('R' == buf[0]) &&
        ('S' == buf[1]) &&
        ('D' == buf[2]) &&
        ('S' == buf[3]) )
   {
     uint32_t age = EXTRACTOR_forensic_le32_ (&buf[20]);
 
     /* The symbol-server spelling: the GUID with its first three fields
        printed as numbers, then the age.  That is the string a lookup
        against a symbol store is keyed on. */
     if (0 !=
         EXTRACTOR_forensic_emit_ (ctx->ec,
                                   "pecoff",
                                   EXTRACTOR_METATYPE_BUILD_ID,
                                   "%08X%04X%04X%02X%02X%02X%02X%02X%02X%02X%02X%X",
                                   (unsigned int) EXTRACTOR_forensic_le32_ (
                                     &buf[4]),
                                   (unsigned int) EXTRACTOR_forensic_le16_ (
                                     &buf[8]),
                                   (unsigned int) EXTRACTOR_forensic_le16_ (
                                     &buf[10]),
                                   buf[12], buf[13], buf[14], buf[15],
                                   buf[16], buf[17], buf[18], buf[19],
                                   (unsigned int) age))
       return 1;
     return EXTRACTOR_forensic_emit_text_ (ctx->ec,
                                           "pecoff",
                                           EXTRACTOR_METATYPE_DEBUG_PATH,
                                           (const char *) &buf[24],
                                           want - 24);
   }
   if ( ('N' == buf[0]) &&
        ('B' == buf[1]) &&
        ('1' == buf[2]) &&
        ('0' == buf[3]) )
   {
     if (0 !=
         EXTRACTOR_forensic_emit_ (ctx->ec,
                                   "pecoff",
                                   EXTRACTOR_METATYPE_BUILD_ID,
                                   "NB10:%08X%X",
                                   (unsigned int) EXTRACTOR_forensic_le32_ (
                                     &buf[12]),
                                   (unsigned int) EXTRACTOR_forensic_le32_ (
                                     &buf[16])))
       return 1;
     return EXTRACTOR_forensic_emit_text_ (ctx->ec,
                                           "pecoff",
                                           EXTRACTOR_METATYPE_DEBUG_PATH,
                                           (const char *) &buf[16],
                                           want - 16);
   }
   return 0;
 }
 
 
 /**
  * Walk the debug directory.
  *
  * @param ctx image being parsed
  * @param rva address of the directory
  * @param size number of bytes in the directory
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 pe_parse_debug (struct pe_context *ctx,
                 uint32_t rva,
                 uint32_t size)
 {
   unsigned int count = size / 28;
 
   if (count > 16)
     count = 16;
   for (unsigned int i = 0; i < count; i++)
   {
     unsigned char ent[28];
 
     if (! pe_read_rva (ctx,
                        rva + i * 28,
                        ent,
                        sizeof (ent)))
       return 0;
     if (2 != EXTRACTOR_forensic_le32_ (&ent[12]))
       continue;   /* not IMAGE_DEBUG_TYPE_CODEVIEW */
     if (0 !=
         pe_parse_codeview (ctx,
                            EXTRACTOR_forensic_le32_ (&ent[20]),
                            EXTRACTOR_forensic_le32_ (&ent[16])))
       return 1;
     break;   /* one CodeView record is all any image has */
   }
   return 0;
 }
 
 
 /* ------------------------------------------------------------------ */
 /* version resource                                                    */
 /* ------------------------------------------------------------------ */
 
 
 /**
  * Round @a v up to the next multiple of four.
  *
  * Every block in a VS_VERSIONINFO starts on a 32-bit boundary measured
  * from the start of the resource.
  *
  * @param v the value
  * @return @a v rounded up, or 0 on overflow
  */
 static size_t
 pe_align4 (size_t v)
 {
   if (v > SIZE_MAX - 3)
     return 0;
   return (v + 3) & ~((size_t) 3);
 }
 
 
 /**
  * Number of bytes the UTF-16LE key at @a p occupies, terminator
  * included.
  *
  * @param p start of the key
  * @param avail number of bytes readable at @a p
  * @return the length, 0 if the key is not terminated within @a avail
  */
 static size_t
 pe_key_bytes (const unsigned char *p,
               size_t avail)
 {
   for (size_t i = 0; i + 1 < avail; i += 2)
     if (0 == EXTRACTOR_forensic_le16_ (&p[i]))
       return i + 2;
   return 0;
 }
 
 
 /**
  * Does the UTF-16LE key at @a p spell @a ascii?
  *
  * @param p start of the key
  * @param avail number of bytes readable at @a p
  * @param ascii the name to compare against
  * @return 1 if they match, 0 if not
  */
 static int
 pe_key_is (const unsigned char *p,
            size_t avail,
            const char *ascii)
 {
   size_t i = 0;
 
   while ('\0' != ascii[i])
   {
     if (2 * i + 1 >= avail)
       return 0;
     if (EXTRACTOR_forensic_le16_ (&p[2 * i]) != (uint16_t) (unsigned char)
         ascii[i])
       return 0;
     i++;
   }
   if (2 * i + 1 >= avail)
     return 0;
   return (0 == EXTRACTOR_forensic_le16_ (&p[2 * i]));
 }
 
 
 /**
  * Mapping from a VERSIONINFO string name to the meta data type we
  * report it as.
  */
 struct pe_version_field
 {
   /**
    * Name as it appears in the StringTable.
    */
   const char *key;
 
   /**
    * Type to report the value under.
    */
   enum EXTRACTOR_MetaType type;
 };
 
 
 /**
  * The StringFileInfo names worth reporting.  Everything else in there
  * is vendor-specific noise.
  */
 static const struct pe_version_field pe_version_fields[] = {
   { "CompanyName", EXTRACTOR_METATYPE_COMPANY },
   { "FileDescription", EXTRACTOR_METATYPE_DESCRIPTION },
   { "ProductName", EXTRACTOR_METATYPE_PRODUCT_NAME },
   { "ProductVersion", EXTRACTOR_METATYPE_PRODUCT_VERSION },
   { "FileVersion", EXTRACTOR_METATYPE_SOFTWARE_VERSION },
   { "OriginalFilename", EXTRACTOR_METATYPE_FILENAME },
   { "LegalCopyright", EXTRACTOR_METATYPE_COPYRIGHT },
   { "LegalTrademarks", EXTRACTOR_METATYPE_LICENSE },
   { "InternalName", EXTRACTOR_METATYPE_TITLE },
   { "Comments", EXTRACTOR_METATYPE_COMMENT },
   { NULL, EXTRACTOR_METATYPE_RESERVED }
 };
 
 
 /**
  * Report one String entry of a StringTable.
  *
  * @param ec extraction context
  * @param b start of the String structure
  * @param len number of bytes readable at @a b
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 pe_parse_version_string (struct EXTRACTOR_ExtractContext *ec,
                          const unsigned char *b,
                          size_t len)
 {
   size_t keylen;
   size_t value;
 
   if (len < 8)
     return 0;
   keylen = pe_key_bytes (&b[6],
                          len - 6);
   if (0 == keylen)
     return 0;
   value = pe_align4 (6 + keylen);
   if ( (0 == value) ||
        (value >= len) )
     return 0;
   for (unsigned int i = 0; NULL != pe_version_fields[i].key; i++)
   {
     if (! pe_key_is (&b[6],
                      len - 6,
                      pe_version_fields[i].key))
       continue;
     /* The declared value length is in characters for text values and in
        bytes for binary ones, and writers disagree about which applies.
        The enclosing block length is unambiguous, so hand the rest of
        the block to a converter that stops at the NUL. */
     return EXTRACTOR_forensic_emit_utf16le_ (ec,
                                              "pecoff",
                                              pe_version_fields[i].type,
                                              &b[value],
                                              len - value);
   }
   return 0;
 }
 
 
 /**
  * Walk one StringTable, which holds the strings for a single language
  * and code page.
  *
  * @param ec extraction context
  * @param b start of the StringTable structure
  * @param len number of bytes readable at @a b
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 pe_parse_string_table (struct EXTRACTOR_ExtractContext *ec,
                        const unsigned char *b,
                        size_t len)
 {
   size_t keylen;
   size_t pos;
 
   if (len < 8)
     return 0;
   keylen = pe_key_bytes (&b[6],
                          len - 6);
   if (0 == keylen)
     return 0;
   pos = pe_align4 (6 + keylen);
   for (unsigned int n = 0;
        (0 != pos) && (pos + 6 <= len) && (n < EXTRACTOR_FORENSIC_MAX_ITEMS);
        n++)
   {
     size_t slen = EXTRACTOR_forensic_le16_ (&b[pos]);
     size_t have;
 
     if (slen < 8)
       break;   /* no forward progress possible */
     have = len - pos;
     if (have > slen)
       have = slen;
     if (0 !=
         pe_parse_version_string (ec,
                                  &b[pos],
                                  have))
       return 1;
     pos = pe_align4 (pos + slen);
   }
   return 0;
 }
 
 
 /**
  * Walk a StringFileInfo block and its per-language string tables.
  *
  * @param ec extraction context
  * @param b start of the StringFileInfo structure
  * @param len number of bytes readable at @a b
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 pe_parse_string_file_info (struct EXTRACTOR_ExtractContext *ec,
                            const unsigned char *b,
                            size_t len)
 {
   size_t keylen;
   size_t pos;
 
   if (len < 8)
     return 0;
   keylen = pe_key_bytes (&b[6],
                          len - 6);
   if (0 == keylen)
     return 0;
   pos = pe_align4 (6 + keylen);
   for (unsigned int n = 0;
        (0 != pos) && (pos + 6 <= len) && (n < 8);
        n++)
   {
     size_t tlen = EXTRACTOR_forensic_le16_ (&b[pos]);
     size_t have;
 
     if (tlen < 8)
       break;
     have = len - pos;
     if (have > tlen)
       have = tlen;
     if (0 !=
         pe_parse_string_table (ec,
                                &b[pos],
                                have))
       return 1;
     pos = pe_align4 (pos + tlen);
   }
   return 0;
 }
 
 
 /**
  * Parse a VS_VERSIONINFO resource.
  *
  * @param ec extraction context
  * @param b start of the resource
  * @param len number of bytes readable at @a b
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 pe_parse_version_info (struct EXTRACTOR_ExtractContext *ec,
                        const unsigned char *b,
                        size_t len)
 {
   size_t total;
   size_t vallen;
   size_t keylen;
   size_t pos;
 
   if (len < 8)
     return 0;
   total = EXTRACTOR_forensic_le16_ (&b[0]);
   if ( (total < 8) ||
        (total > len) )
     total = len;
   vallen = EXTRACTOR_forensic_le16_ (&b[2]);
   keylen = pe_key_bytes (&b[6],
                          total - 6);
   if (0 == keylen)
     return 0;
   if (! pe_key_is (&b[6],
                    total - 6,
                    "VS_VERSION_INFO"))
     return 0;
   pos = pe_align4 (6 + keylen);
   if ( (0 == pos) ||
        (pos >= total) )
     return 0;
   if ( (52 <= vallen) &&
        (pos + 52 <= total) &&
        (0xFEEF04BDU == EXTRACTOR_forensic_le32_ (&b[pos])) )
   {
     uint32_t fv_ms = EXTRACTOR_forensic_le32_ (&b[pos + 8]);
     uint32_t fv_ls = EXTRACTOR_forensic_le32_ (&b[pos + 12]);
 
     if (0 !=
         EXTRACTOR_forensic_emit_ (ec,
                                   "pecoff",
                                   EXTRACTOR_METATYPE_FORMAT_VERSION,
                                   "%u.%u.%u.%u",
                                   (unsigned int) (fv_ms >> 16),
                                   (unsigned int) (fv_ms & 0xFFFF),
                                   (unsigned int) (fv_ls >> 16),
                                   (unsigned int) (fv_ls & 0xFFFF)))
       return 1;
   }
   pos = pe_align4 (pos + vallen);
   for (unsigned int n = 0;
        (0 != pos) && (pos + 6 <= total) && (n < 8);
        n++)
   {
     size_t clen = EXTRACTOR_forensic_le16_ (&b[pos]);
     size_t have;
 
     if (clen < 8)
       break;
     have = total - pos;
     if (have > clen)
       have = clen;
     if (pe_key_is (&b[pos + 6],
                    have - 6,
                    "StringFileInfo"))
     {
       if (0 !=
           pe_parse_string_file_info (ec,
                                      &b[pos],
                                      have))
         return 1;
     }
     pos = pe_align4 (pos + clen);
   }
   return 0;
 }
 
 
 /**
  * Find the RT_VERSION leaf in the resource directory tree and parse
  * the resource it points at.
  *
  * The tree is three levels deep (type, name, language); we want the
  * first leaf under type 16 and do not care which language it is.
  *
  * @param ctx image being parsed
  * @param rva address of the resource directory
  * @param size number of bytes in the resource directory
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 pe_parse_resources (struct pe_context *ctx,
                     uint32_t rva,
                     uint32_t size)
 {
   unsigned char *tree;
   unsigned char *res;
   size_t tlen = size;
   uint32_t node = 0;
   uint32_t leaf = 0;
   uint32_t data_rva;
   uint32_t data_size;
   int found = 0;
   int ret = 0;
 
   if (size < 16)
     return 0;
   if (tlen > PE_MAX_RESOURCE_DIR)
     tlen = PE_MAX_RESOURCE_DIR;
   if (NULL == (tree = malloc (tlen)))
     return 0;
   if (! pe_read_rva (ctx,
                      rva,
                      tree,
                      tlen))
   {
     free (tree);
     return 0;
   }
   /* level 1: resource types */
   {
     unsigned int named = EXTRACTOR_forensic_le16_ (&tree[12]);
     unsigned int ids = EXTRACTOR_forensic_le16_ (&tree[14]);
     size_t base;
 
     if (named > 1024)
       named = 1024;
     if (ids > 1024)
       ids = 1024;
     base = 16 + ((size_t) named) * 8;
     for (unsigned int i = 0; i < ids; i++)
     {
       size_t at = base + ((size_t) i) * 8;
 
       if (at + 8 > tlen)
         break;
       if (16 != EXTRACTOR_forensic_le32_ (&tree[at]))
         continue;   /* not RT_VERSION */
       node = EXTRACTOR_forensic_le32_ (&tree[at + 4]);
       if (0 == (node & 0x80000000U))
       {
         free (tree);
         return 0;   /* a type entry must point at a subdirectory */
       }
       node &= 0x7FFFFFFFU;
       found = 1;
       break;
     }
   }
   if (! found)
   {
     free (tree);
     return 0;
   }
   /* levels 2 and 3: take the first entry each time */
   for (unsigned int level = 0; level < 2; level++)
   {
     unsigned int named;
     unsigned int ids;
 
     if (((size_t) node) + 16 > tlen)
     {
       free (tree);
       return 0;
     }
     named = EXTRACTOR_forensic_le16_ (&tree[node + 12]);
     ids = EXTRACTOR_forensic_le16_ (&tree[node + 14]);
     if (0 == named + ids)
     {
       free (tree);
       return 0;
     }
     if (((size_t) node) + 24 > tlen)
     {
       free (tree);
       return 0;
     }
     leaf = EXTRACTOR_forensic_le32_ (&tree[node + 20]);
     if (0 == (leaf & 0x80000000U))
       break;   /* a data entry: we are at the bottom */
     node = leaf & 0x7FFFFFFFU;
     leaf = 0;
   }
   if ( (0 == leaf) ||
        (0 != (leaf & 0x80000000U)) ||
        (((size_t) leaf) + 16 > tlen) )
   {
     free (tree);
     return 0;
   }
   data_rva = EXTRACTOR_forensic_le32_ (&tree[leaf]);
   data_size = EXTRACTOR_forensic_le32_ (&tree[leaf + 4]);
   free (tree);
   if (data_size < 8)
     return 0;
   if (data_size > PE_MAX_VERSION_RESOURCE)
     data_size = PE_MAX_VERSION_RESOURCE;
   if (NULL == (res = malloc (data_size)))
     return 0;
   if (pe_read_rva (ctx,
                    data_rva,
                    res,
                    data_size))
     ret = pe_parse_version_info (ctx->ec,
                                  res,
                                  data_size);
   free (res);
   return ret;
 }
 
 
 /* ------------------------------------------------------------------ */
 /* imports                                                             */
 /* ------------------------------------------------------------------ */
 
 
 /**
  * A window of file data mapped by relative virtual address.
  */
 struct pe_window
 {
   /**
    * The bytes, or NULL if nothing is mapped.
    */
   unsigned char *buf;
 
   /**
    * Address @e buf starts at.
    */
   uint32_t base;
 
   /**
    * Number of bytes in @e buf.
    */
   size_t len;
 };
 
 
 /**
  * Point at @a len bytes at @a rva inside @a w.
  *
  * @param w the window
  * @param rva address wanted
  * @param len number of bytes wanted
  * @return pointer into the window, NULL if the range is not mapped
  */
 static const unsigned char *
 pe_window_at (const struct pe_window *w,
               uint32_t rva,
               size_t len)
 {
   uint32_t delta;
 
   if ( (NULL == w->buf) ||
        (rva < w->base) )
     return NULL;
   delta = rva - w->base;
   if ( (delta > w->len) ||
        (w->len - delta < len) )
     return NULL;
   return &w->buf[delta];
 }
 
 
 /**
  * Copy a NUL-terminated ASCII name out of @a w.
  *
  * @param w the window
  * @param rva address of the name
  * @param[out] out where to store the name
  * @param size number of bytes in @a out
  * @param lower 1 to fold the name to lower case, as the import hash
  *        requires, 0 to keep it as the linker wrote it
  * @return 1 on success, 0 if the name is not mapped or not terminated
  */
 static int
 pe_window_name (const struct pe_window *w,
                 uint32_t rva,
                 char *out,
                 size_t size,
                 int lower)
 {
   const unsigned char *p = pe_window_at (w,
                                          rva,
                                          1);
   size_t avail;
   size_t i;
 
   if (NULL == p)
     return 0;
   avail = w->len - (size_t) (rva - w->base);
   if (avail > size - 1)
     avail = size - 1;
   for (i = 0; i < avail; i++)
   {
     unsigned char c = p[i];
 
     if ('\0' == c)
       break;
     if ( (c < 0x20) ||
          (c > 0x7E) )
       return 0;   /* module and function names are ASCII */
     if ( (lower) &&
          ('A' <= c) &&
          ('Z' >= c) )
       c = (unsigned char) (c - 'A' + 'a');
     out[i] = (char) c;
   }
   if (i == avail)
     return 0;   /* not terminated inside the window */
   out[i] = '\0';
   return (0 != i);
 }
 
 
 /**
  * Compute the import hash over the import table.
  *
  * The hash is MD5 over `module.function' pairs, lower-cased, joined by
  * commas, in the order the linker wrote them; the module's `.dll',
  * `.ocx' or `.sys' suffix is dropped.  That is the definition every
  * other tool uses, so any deviation makes the value useless for
  * comparison -- which is why this bails out instead of guessing
  * whenever part of the table is out of reach.
  *
  * @param ctx image being parsed
  * @param w window covering the import table
  * @param rva address of the import descriptor array
  * @param[out] hash where to store the 16-byte digest
  * @return 1 on success, 0 if no hash could be computed
  */
 static int
 pe_import_hash (struct pe_context *ctx,
                 const struct pe_window *w,
                 uint32_t rva,
                 unsigned char *hash)
 {
   struct md5_context md5;
   size_t thunk_size = ctx->pe32plus ? 8 : 4;
   unsigned int total = 0;
   int any = 0;
 
   md5_init (&md5);
   for (unsigned int d = 0; d < PE_MAX_IMPORT_DLLS; d++)
   {
     const unsigned char *desc = pe_window_at (w,
                                               rva + d * 20,
                                               20);
     char lib[PE_MAX_NAME];
     size_t liblen;
     uint32_t thunks;
 
     if (NULL == desc)
       return 0;
     if ( (0 == EXTRACTOR_forensic_le32_ (&desc[0])) &&
          (0 == EXTRACTOR_forensic_le32_ (&desc[12])) &&
          (0 == EXTRACTOR_forensic_le32_ (&desc[16])) )
       break;   /* the all-zero terminator */
     if (! pe_window_name (w,
                           EXTRACTOR_forensic_le32_ (&desc[12]),
                           lib,
                           sizeof (lib),
                           1))
       return 0;
     liblen = strlen (lib);
     if ( (liblen > 4) &&
          ('.' == lib[liblen - 4]) &&
          ( (0 == strcmp (&lib[liblen - 3], "dll")) ||
            (0 == strcmp (&lib[liblen - 3], "ocx")) ||
            (0 == strcmp (&lib[liblen - 3], "sys")) ) )
     {
       liblen -= 4;
       lib[liblen] = '\0';
     }
     thunks = EXTRACTOR_forensic_le32_ (&desc[0]);
     if (0 == thunks)
       thunks = EXTRACTOR_forensic_le32_ (&desc[16]);
     if (0 == thunks)
       return 0;
     for (unsigned int t = 0;; t++)
     {
       const unsigned char *te;
       uint64_t v;
       char func[PE_MAX_NAME];
 
       if (total >= PE_MAX_IMPORT_FUNCS)
         return 0;   /* would no longer match anyone else's value */
       te = pe_window_at (w,
                          thunks + t * (uint32_t) thunk_size,
                          thunk_size);
       if (NULL == te)
         return 0;
       v = ctx->pe32plus
           ? EXTRACTOR_forensic_le64_ (te)
           : (uint64_t) EXTRACTOR_forensic_le32_ (te);
       if (0 == v)
         break;
       if (0 != (v & (ctx->pe32plus
                      ? 0x8000000000000000ULL
                      : 0x80000000ULL)))
       {
         /* Imported by ordinal.  Tools that know the export tables of a
            few system libraries substitute the real name here; without
            those tables the documented fallback spelling is used. */
         snprintf (func,
                   sizeof (func),
                   "ord%u",
                   (unsigned int) (v & 0xFFFFU));
       }
       else
       {
         uint32_t name_rva = (uint32_t) (v & 0x7FFFFFFFU);
 
         if (name_rva > UINT32_MAX - 2)
           return 0;
         if (! pe_window_name (w,
                               name_rva + 2,
                               func,
                               sizeof (func),
                               1))
           return 0;
       }
       if (any)
         md5_update (&md5,
                     ",",
                     1);
       md5_update (&md5,
                   lib,
                   liblen);
       md5_update (&md5,
                   ".",
                   1);
       md5_update (&md5,
                   func,
                   strlen (func));
       any = 1;
       total++;
     }
   }
   if (! any)
     return 0;
   md5_final (&md5,
              hash);
   return 1;
 }
 
 
 /**
  * Report the imported modules and the import hash.
  *
  * @param ctx image being parsed
  * @param rva address of the import descriptor array
  * @param size number of bytes in the import directory
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 pe_parse_imports (struct pe_context *ctx,
                   uint32_t rva,
                   uint32_t size)
 {
   struct pe_window w = { NULL, 0, 0 };
   unsigned char hash[16];
   unsigned int count = 0;
   int ret = 0;
 
   if (size < 20)
     return 0;
   /* Map the section the descriptors live in: the lookup tables and the
      hint/name table are in there too, so one read covers the lot. */
   for (unsigned int i = 0; i < ctx->num_sections; i++)
   {
     const struct pe_section *s = &ctx->sections[i];
     size_t len = s->raw_size;
 
     if ( (0 == s->raw_size) ||
          (rva < s->vaddr) ||
          (rva - s->vaddr >= s->raw_size) )
       continue;
     if (((uint64_t) s->raw_ptr) >= ctx->fsize)
       break;
     if (len > ctx->fsize - s->raw_ptr)
       len = (size_t) (ctx->fsize - s->raw_ptr);
     if (len > PE_IMPORT_WINDOW)
       len = PE_IMPORT_WINDOW;
     if (NULL == (w.buf = malloc (len)))
       break;
     if (! EXTRACTOR_forensic_read_ (ctx->ec,
                                     (int64_t) s->raw_ptr,
                                     w.buf,
                                     len))
     {
       free (w.buf);
       w.buf = NULL;
       break;
     }
     w.base = s->vaddr;
     w.len = len;
     break;
   }
   if (NULL == w.buf)
     return 0;
   for (unsigned int d = 0;
        (d < PE_MAX_IMPORT_DLLS) && (count < EXTRACTOR_FORENSIC_MAX_ITEMS);
        d++)
   {
     const unsigned char *desc = pe_window_at (&w,
                                               rva + d * 20,
                                               20);
     char lib[PE_MAX_NAME];
 
     if (NULL == desc)
       break;
     if ( (0 == EXTRACTOR_forensic_le32_ (&desc[0])) &&
          (0 == EXTRACTOR_forensic_le32_ (&desc[12])) &&
          (0 == EXTRACTOR_forensic_le32_ (&desc[16])) )
       break;
     if (! pe_window_name (&w,
                           EXTRACTOR_forensic_le32_ (&desc[12]),
                           lib,
                           sizeof (lib),
                           0))
       break;
     count++;
     if (0 !=
         EXTRACTOR_forensic_emit_text_ (ctx->ec,
                                        "pecoff",
                                        EXTRACTOR_METATYPE_LIBRARY_DEPENDENCY,
                                        lib,
                                        strlen (lib)))
     {
       ret = 1;
       goto cleanup;
     }
   }
   if (pe_import_hash (ctx,
                       &w,
                       rva,
                       hash))
     ret = EXTRACTOR_forensic_emit_hex_ (ctx->ec,
                                         "pecoff",
                                         EXTRACTOR_METATYPE_IMPORT_HASH,
                                         hash,
                                         sizeof (hash));
 cleanup:
   free (w.buf);
   return ret;
 }
 
 
 /* ------------------------------------------------------------------ */
 /* exports, certificates, entropy                                      */
 /* ------------------------------------------------------------------ */
 
 
 /**
  * Report the internal name a DLL exports itself under and how many
  * entries it exports.
  *
  * The name in the export directory is the name the module had when it
  * was linked, which is often not the name of the file on disk.
  *
  * @param ctx image being parsed
  * @param rva address of the export directory
  * @param size number of bytes in the export directory
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 pe_parse_exports (struct pe_context *ctx,
                   uint32_t rva,
                   uint32_t size)
 {
   unsigned char dir[40];
   char name[PE_MAX_NAME];
   uint64_t off;
   uint64_t avail;
   uint32_t functions;
 
   if (size < sizeof (dir))
     return 0;
   if (! pe_read_rva (ctx,
                      rva,
                      dir,
                      sizeof (dir)))
     return 0;
   functions = EXTRACTOR_forensic_le32_ (&dir[20]);
   if (functions <= 0xFFFF)
   {
     if (0 !=
         EXTRACTOR_forensic_emit_ (ctx->ec,
                                   "pecoff",
                                   EXTRACTOR_METATYPE_ENTRY_COUNT,
                                   "%u",
                                   (unsigned int) functions))
       return 1;
   }
   if (! pe_rva_to_offset (ctx,
                           EXTRACTOR_forensic_le32_ (&dir[12]),
                           &off,
                           &avail))
     return 0;
   if (avail > sizeof (name))
     avail = sizeof (name);
   if (! EXTRACTOR_forensic_read_ (ctx->ec,
                                   (int64_t) off,
                                   name,
                                   (size_t) avail))
     return 0;
   return EXTRACTOR_forensic_emit_text_ (ctx->ec,
                                         "pecoff",
                                         EXTRACTOR_METATYPE_FILENAME,
                                         name,
                                         (size_t) avail);
 }
 
 
 /**
  * Report what the certificate table says.
  *
  * Parsing PKCS#7 properly means an ASN.1 decoder, which is more than
  * this pass can justify.  The subject common names are still findable
  * without one: the DER encoding of the commonName attribute is the
  * fixed five-byte sequence 06 03 55 04 03 followed by a tagged string,
  * so a scan finds every CN in the chain.  Which one is the signer and
  * which the issuer is not decided here, so they are all reported.
  *
  * @param ctx image being parsed
  * @param offset file offset of the certificate table
  * @param size number of bytes in the certificate table
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 pe_parse_certificates (struct pe_context *ctx,
                        uint32_t offset,
                        uint32_t size)
 {
   unsigned char *buf;
   size_t len = size;
   unsigned int found = 0;
   int ret = 0;
 
   if ( (size < 8) ||
        (offset >= ctx->fsize) ||
        (size > ctx->fsize - offset) )
     return 0;
   if (len > PE_MAX_CERT_SCAN)
     len = PE_MAX_CERT_SCAN;
   if (NULL == (buf = malloc (len)))
     return 0;
   if (! EXTRACTOR_forensic_read_ (ctx->ec,
                                   (int64_t) offset,
                                   buf,
                                   len))
   {
     free (buf);
     return 0;
   }
   for (size_t i = 0;
        (i + 7 < len) && (found < 8);
        i++)
   {
     size_t vlen;
 
     if ( (0x06 != buf[i]) ||
          (0x03 != buf[i + 1]) ||
          (0x55 != buf[i + 2]) ||
          (0x04 != buf[i + 3]) ||
          (0x03 != buf[i + 4]) )
       continue;
     /* 0x0C UTF8String, 0x13 PrintableString, 0x16 IA5String */
     if ( (0x0C != buf[i + 5]) &&
          (0x13 != buf[i + 5]) &&
          (0x16 != buf[i + 5]) )
       continue;
     vlen = buf[i + 6];
     if ( (vlen < 1) ||
          (vlen > 127) ||
          (i + 7 + vlen > len) )
       continue;
     found++;
     if (0 !=
         EXTRACTOR_forensic_emit_text_ (ctx->ec,
                                        "pecoff",
                                        EXTRACTOR_METATYPE_SIGNER,
                                        (const char *) &buf[i + 7],
                                        vlen))
     {
       ret = 1;
       break;
     }
     i += 6 + vlen;
   }
   free (buf);
   if ( (0 == ret) &&
        (0 == found) )
     ret = EXTRACTOR_forensic_emit_ (ctx->ec,
                                     "pecoff",
                                     EXTRACTOR_METATYPE_SIGNER,
                                     "present");
   return ret;
 }
 
 
 /**
  * Report the entropy of the most disordered section.
  *
  * A section above roughly 7.2 bits per byte holds compressed,
  * encrypted or packed data rather than code, which is the cheapest
  * signal there is that an executable is not what it appears to be.
  *
  * @param ctx image being parsed
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 pe_parse_entropy (struct pe_context *ctx)
 {
   unsigned char *buf;
   double best = -1.0;
   const char *best_name = NULL;
   unsigned int sampled = 0;
 
   if (NULL == (buf = malloc (PE_ENTROPY_SAMPLE)))
     return 0;
   for (unsigned int i = 0;
        (i < ctx->num_sections) && (sampled < PE_MAX_ENTROPY_SECTIONS);
        i++)
   {
     const struct pe_section *s = &ctx->sections[i];
     size_t len = s->raw_size;
     double e;
 
     if (s->raw_size < PE_MIN_ENTROPY_SECTION)
       continue;
     if (((uint64_t) s->raw_ptr) >= ctx->fsize)
       continue;
     if (len > ctx->fsize - s->raw_ptr)
       len = (size_t) (ctx->fsize - s->raw_ptr);
     if (len > PE_ENTROPY_SAMPLE)
       len = PE_ENTROPY_SAMPLE;
     if (len < PE_MIN_ENTROPY_SECTION)
       continue;
     if (! EXTRACTOR_forensic_read_ (ctx->ec,
                                     (int64_t) s->raw_ptr,
                                     buf,
                                     len))
       continue;
     sampled++;
     e = EXTRACTOR_forensic_entropy_ (buf,
                                      len);
     if (e > best)
     {
       best = e;
       best_name = s->name;
     }
   }
   free (buf);
   if (NULL == best_name)
     return 0;
   return EXTRACTOR_forensic_emit_ (ctx->ec,
                                    "pecoff",
                                    EXTRACTOR_METATYPE_ENTROPY,
                                    "%.2f bits/byte (%s)",
                                    best,
                                    best_name);
 }
 
 
 /* ------------------------------------------------------------------ */
 /* entry point                                                         */
 /* ------------------------------------------------------------------ */
 
 
 /**
  * Main entry method for the PE/COFF extraction plugin.
  *
  * @param ec extraction context provided to the plugin
  */
 void
 EXTRACTOR_pecoff_extract_method (struct EXTRACTOR_ExtractContext *ec);
 
 void
 EXTRACTOR_pecoff_extract_method (struct EXTRACTOR_ExtractContext *ec)
 {
   struct pe_context ctx;
   unsigned char dos[64];
   unsigned char coff[24];
   unsigned char opt[256];
   uint32_t e_lfanew;
   uint16_t machine;
   uint16_t nsec;
   uint32_t timestamp;
   uint16_t opt_size;
   uint16_t characteristics;
   uint16_t magic;
   uint16_t subsystem;
   uint16_t dll_flags;
   uint32_t entry_point;
   uint32_t num_dirs;
   size_t dir_at;
   uint32_t dirs[16][2];
   const char *s;
   char list[256];
 
   memset (&ctx,
           0,
           sizeof (ctx));
   ctx.ec = ec;
   /* Bail out on the first two bytes: almost nothing we are handed is a
      PE, and the magic is at offset zero. */
   if (! EXTRACTOR_forensic_read_ (ec,
                                   0,
                                   dos,
                                   sizeof (dos)))
     return;
   if ( ('M' != dos[0]) ||
        ('Z' != dos[1]) )
     return;
   ctx.fsize = ec->get_size (ec->cls);
   if ( (0 == ctx.fsize) ||
        (UINT64_MAX == ctx.fsize) )
     return;
   e_lfanew = EXTRACTOR_forensic_le32_ (&dos[0x3C]);
   if ( (e_lfanew < sizeof (dos)) ||
        (((uint64_t) e_lfanew) + 24 > ctx.fsize) )
     return;
   if (! EXTRACTOR_forensic_read_ (ec,
                                   (int64_t) e_lfanew,
                                   coff,
                                   sizeof (coff)))
     return;
   if ( ('P' != coff[0]) ||
        ('E' != coff[1]) ||
        ('\0' != coff[2]) ||
        ('\0' != coff[3]) )
     return;
   machine = EXTRACTOR_forensic_le16_ (&coff[4]);
   nsec = EXTRACTOR_forensic_le16_ (&coff[6]);
   timestamp = EXTRACTOR_forensic_le32_ (&coff[8]);
   opt_size = EXTRACTOR_forensic_le16_ (&coff[20]);
   characteristics = EXTRACTOR_forensic_le16_ (&coff[22]);
   if (0 !=
       ec->proc (ec->cls,
                 "pecoff",
                 EXTRACTOR_METATYPE_MIMETYPE,
                 EXTRACTOR_METAFORMAT_UTF8,
                 "text/plain",
                 "application/vnd.microsoft.portable-executable",
                 strlen ("application/vnd.microsoft.portable-executable") + 1))
     return;
   if (opt_size < 96)
     return;   /* an object file, not an image */
   memset (opt,
           0,
           sizeof (opt));
   if (! EXTRACTOR_forensic_read_ (ec,
                                   (int64_t) e_lfanew + 24,
                                   opt,
                                   (opt_size > sizeof (opt))
                                   ? sizeof (opt)
                                   : opt_size))
     return;
   magic = EXTRACTOR_forensic_le16_ (&opt[0]);
   if (0x20b == magic)
     ctx.pe32plus = 1;
   else if (0x10b != magic)
     return;   /* 0x107 is a ROM image, which has no optional header */
   if (ctx.pe32plus && (opt_size < 112))
     return;   /* the 64-bit header cannot be that short */
   entry_point = EXTRACTOR_forensic_le32_ (&opt[16]);
   subsystem = EXTRACTOR_forensic_le16_ (&opt[68]);
   dll_flags = EXTRACTOR_forensic_le16_ (&opt[70]);
   ctx.size_of_headers = EXTRACTOR_forensic_le32_ (&opt[60]);
   dir_at = ctx.pe32plus ? 112 : 96;
   num_dirs = EXTRACTOR_forensic_le32_ (&opt[dir_at - 4]);
   if (num_dirs > 16)
     num_dirs = 16;
   memset (dirs,
           0,
           sizeof (dirs));
   for (uint32_t i = 0; i < num_dirs; i++)
   {
     if (dir_at + ((size_t) i) * 8 + 8 > opt_size)
       break;
     if (dir_at + ((size_t) i) * 8 + 8 > sizeof (opt))
       break;
     dirs[i][0] = EXTRACTOR_forensic_le32_ (&opt[dir_at + ((size_t) i) * 8]);
     dirs[i][1] = EXTRACTOR_forensic_le32_ (&opt[dir_at + ((size_t) i) * 8 + 4]);
   }
 
   if (0 !=
       EXTRACTOR_forensic_emit_ (ec,
                                 "pecoff",
                                 EXTRACTOR_METATYPE_FORMAT,
                                 "%s",
                                 ctx.pe32plus ? "PE32+" : "PE32"))
     return;
   if (0 != (characteristics & 0x2000))
     s = "DLL";
   else if (0 != (characteristics & 0x1000))
     s = "system file";
   else if (0 != (characteristics & 0x0002))
     s = "executable";
   else
     s = NULL;
   if ( (NULL != s) &&
        (0 !=
         EXTRACTOR_forensic_emit_ (ec,
                                   "pecoff",
                                   EXTRACTOR_METATYPE_RESOURCE_TYPE,
                                   "%s",
                                   s)) )
     return;
   if (NULL != (s = pe_machine_name (machine)))
   {
     if (0 !=
         EXTRACTOR_forensic_emit_ (ec,
                                   "pecoff",
                                   EXTRACTOR_METATYPE_TARGET_ARCHITECTURE,
                                   "%s",
                                   s))
       return;
   }
   else if (0 !=
            EXTRACTOR_forensic_emit_ (ec,
                                      "pecoff",
                                      EXTRACTOR_METATYPE_TARGET_ARCHITECTURE,
                                      "0x%04x",
                                      (unsigned int) machine))
   {
     return;
   }
   if (0 !=
       EXTRACTOR_forensic_emit_ (ec,
                                 "pecoff",
                                 EXTRACTOR_METATYPE_TARGET_OS,
                                 "Windows"))
     return;
   if (NULL != (s = pe_subsystem_name (subsystem)))
   {
     if (0 !=
         EXTRACTOR_forensic_emit_ (ec,
                                   "pecoff",
                                   EXTRACTOR_METATYPE_SUBSYSTEM,
                                   "%s",
                                   s))
       return;
   }
   if (0 !=
       EXTRACTOR_forensic_emit_ (ec,
                                 "pecoff",
                                 EXTRACTOR_METATYPE_MINIMUM_OS_VERSION,
                                 "%u.%u",
                                 (unsigned int) EXTRACTOR_forensic_le16_ (
                                   &opt[40]),
                                 (unsigned int) EXTRACTOR_forensic_le16_ (
                                   &opt[42])))
     return;
   if (0 !=
       EXTRACTOR_forensic_emit_ (ec,
                                 "pecoff",
                                 EXTRACTOR_METATYPE_TOOLCHAIN,
                                 "linker %u.%u",
                                 (unsigned int) opt[2],
                                 (unsigned int) opt[3]))
     return;
   if (0 !=
       EXTRACTOR_forensic_emit_ (ec,
                                 "pecoff",
                                 EXTRACTOR_METATYPE_ENTRY_POINT,
                                 "0x%08x",
                                 (unsigned int) entry_point))
     return;
   /* A reproducible build puts a hash here rather than a time; the
      helper drops anything outside a plausible range, which is exactly
      the behaviour we want. */
   if (0 !=
       EXTRACTOR_forensic_emit_unix_time_ (ec,
                                           "pecoff",
                                           EXTRACTOR_METATYPE_BUILD_DATE,
                                           (int64_t) timestamp))
     return;
   list[0] = '\0';
   if (0 != (dll_flags & 0x0020))
     pe_append (list, sizeof (list), "HIGH_ENTROPY_VA");
   if (0 != (dll_flags & 0x0040))
     pe_append (list, sizeof (list), "DYNAMIC_BASE");
   if (0 != (dll_flags & 0x0080))
     pe_append (list, sizeof (list), "FORCE_INTEGRITY");
   if (0 != (dll_flags & 0x0100))
     pe_append (list, sizeof (list), "NX_COMPAT");
   if (0 != (dll_flags & 0x0200))
     pe_append (list, sizeof (list), "NO_ISOLATION");
   if (0 != (dll_flags & 0x0400))
     pe_append (list, sizeof (list), "NO_SEH");
   if (0 != (dll_flags & 0x0800))
     pe_append (list, sizeof (list), "NO_BIND");
   if (0 != (dll_flags & 0x1000))
     pe_append (list, sizeof (list), "APPCONTAINER");
   if (0 != (dll_flags & 0x2000))
     pe_append (list, sizeof (list), "WDM_DRIVER");
   if (0 != (dll_flags & 0x4000))
     pe_append (list, sizeof (list), "GUARD_CF");
   if (0 != (dll_flags & 0x8000))
     pe_append (list, sizeof (list), "TERMINAL_SERVER_AWARE");
   if ( ('\0' != list[0]) &&
        (0 !=
         EXTRACTOR_forensic_emit_ (ec,
                                   "pecoff",
                                   EXTRACTOR_METATYPE_SECURITY_MITIGATIONS,
                                   "%s",
                                   list)) )
     return;
 
   /* section table */
   if (nsec > PE_MAX_SECTIONS)
     nsec = PE_MAX_SECTIONS;
   for (uint16_t i = 0; i < nsec; i++)
   {
     struct pe_section *sec = &ctx.sections[ctx.num_sections];
     unsigned char sh[40];
     uint64_t at = ((uint64_t) e_lfanew) + 24 + opt_size + ((uint64_t) i) * 40;
 
     if (at + sizeof (sh) > ctx.fsize)
       break;
     if (! EXTRACTOR_forensic_read_ (ec,
                                     (int64_t) at,
                                     sh,
                                     sizeof (sh)))
       break;
     memcpy (sec->name,
             sh,
             8);
     sec->name[8] = '\0';
     for (unsigned int k = 0; k < 8; k++)
     {
       unsigned char c = (unsigned char) sec->name[k];
 
       if ( (c < 0x20) ||
            (c > 0x7E) )
         sec->name[k] = '\0';
     }
     sec->vsize = EXTRACTOR_forensic_le32_ (&sh[8]);
     sec->vaddr = EXTRACTOR_forensic_le32_ (&sh[12]);
     sec->raw_size = EXTRACTOR_forensic_le32_ (&sh[16]);
     sec->raw_ptr = EXTRACTOR_forensic_le32_ (&sh[20]);
     /* Clamp what the section claims to have in the file to what the
        file actually holds, once, so that everything downstream can
        trust raw_ptr + raw_size. */
     if (((uint64_t) sec->raw_ptr) >= ctx.fsize)
       sec->raw_size = 0;
     else if (sec->raw_size > ctx.fsize - sec->raw_ptr)
       sec->raw_size = (uint32_t) (ctx.fsize - sec->raw_ptr);
     ctx.num_sections++;
   }
 
   /* Rich header, in the gap between the DOS header and the PE header */
   if (e_lfanew > sizeof (dos))
   {
     size_t stub_len = e_lfanew - sizeof (dos);
     unsigned char *stub;
 
     if (stub_len > PE_MAX_DOS_STUB)
       stub_len = PE_MAX_DOS_STUB;
     if (NULL != (stub = malloc (stub_len)))
     {
       int stop = 0;
 
       if (EXTRACTOR_forensic_read_ (ec,
                                     (int64_t) sizeof (dos),
                                     stub,
                                     stub_len))
         stop = pe_parse_rich (ec,
                               stub,
                               stub_len);
       free (stub);
       if (stop)
         return;
     }
   }
 
   if ( (0 != dirs[6][0]) &&
        (0 != pe_parse_debug (&ctx,
                              dirs[6][0],
                              dirs[6][1])) )
     return;
   if ( (0 != dirs[2][0]) &&
        (0 != pe_parse_resources (&ctx,
                                  dirs[2][0],
                                  dirs[2][1])) )
     return;
   if ( (0 != dirs[1][0]) &&
        (0 != pe_parse_imports (&ctx,
                                dirs[1][0],
                                dirs[1][1])) )
     return;
   if ( (0 != dirs[0][0]) &&
        (0 != pe_parse_exports (&ctx,
                                dirs[0][0],
                                dirs[0][1])) )
     return;
   /* Data directory 4 is the one field in the whole format that holds a
      file offset rather than an address. */
   if ( (0 != dirs[4][0]) &&
        (0 != pe_parse_certificates (&ctx,
                                     dirs[4][0],
                                     dirs[4][1])) )
     return;
   (void) pe_parse_entropy (&ctx);
 }
 
 
 /* end of pecoff_extractor.c */