test_pecoff.c (6309B)
1 /* 2 This file is part of libextractor. 3 Copyright (C) 2026 Vidyut Samanta and Christian Grothoff 4 5 libextractor is free software; you can redistribute it and/or modify 6 it under the terms of the GNU General Public License as published 7 by the Free Software Foundation; either version 3, or (at your 8 option) any later version. 9 10 libextractor is distributed in the hope that it will be useful, but 11 WITHOUT ANY WARRANTY; without even the implied warranty of 12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 13 General Public License for more details. 14 15 You should have received a copy of the GNU General Public License 16 along with libextractor; see the file COPYING. If not, write to the 17 Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, 18 Boston, MA 02110-1301, USA. 19 */ 20 /** 21 * @file plugins/test_pecoff.c 22 * @brief testcase for the pecoff plugin 23 * @author Christian Grothoff 24 * 25 * Both inputs are generated by contrib/gen_pecoff_testdata.sh. The 26 * .exe is a real mingw-w64 image, which is what exercises the resource 27 * and import parsing; the .dll is assembled from the specification and 28 * carries the MSVC-only artifacts (Rich header, CodeView record) that 29 * mingw cannot produce. 30 */ 31 #include "platform.h" 32 #include "test_lib.h" 33 34 35 /** 36 * Shorthand for a solution whose value is spelled out in full. 37 */ 38 #define TEXT(type, value) \ 39 { type, EXTRACTOR_METAFORMAT_UTF8, "text/plain", value, \ 40 strlen (value) + 1, 0, 0, NULL } 41 42 /** 43 * Shorthand for a solution matched by a regular expression, used where 44 * the exact value depends on the toolchain that built the input or on 45 * the last digit of a floating point conversion. 46 */ 47 #define MATCH(type, re) \ 48 { type, EXTRACTOR_METAFORMAT_UTF8, "text/plain", re, \ 49 strlen (re), 0, 1, NULL } 50 51 52 /** 53 * Main function for the PE/COFF testcase. 54 * 55 * @param argc number of arguments (ignored) 56 * @param argv arguments (ignored) 57 * @return 0 on success 58 */ 59 int 60 main (int argc, char *argv[]) 61 { 62 struct SolutionData pecoff_exe_sol[] = { 63 TEXT (EXTRACTOR_METATYPE_MIMETYPE, 64 "application/vnd.microsoft.portable-executable"), 65 TEXT (EXTRACTOR_METATYPE_FORMAT, 66 "PE32+"), 67 TEXT (EXTRACTOR_METATYPE_RESOURCE_TYPE, 68 "executable"), 69 TEXT (EXTRACTOR_METATYPE_TARGET_ARCHITECTURE, 70 "x86-64"), 71 TEXT (EXTRACTOR_METATYPE_TARGET_OS, 72 "Windows"), 73 TEXT (EXTRACTOR_METATYPE_SUBSYSTEM, 74 "Windows console"), 75 TEXT (EXTRACTOR_METATYPE_MINIMUM_OS_VERSION, 76 "4.0"), 77 /* the GNU linker writes its own version here */ 78 MATCH (EXTRACTOR_METATYPE_TOOLCHAIN, 79 "^linker 2\\.[0-9]+$"), 80 TEXT (EXTRACTOR_METATYPE_ENTRY_POINT, 81 "0x00001000"), 82 TEXT (EXTRACTOR_METATYPE_BUILD_DATE, 83 "2023-11-14T22:13:20Z"), 84 TEXT (EXTRACTOR_METATYPE_SECURITY_MITIGATIONS, 85 "HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT"), 86 TEXT (EXTRACTOR_METATYPE_LIBRARY_DEPENDENCY, 87 "KERNEL32.dll"), 88 /* MD5 of "kernel32.exitprocess"; matches what pefile computes */ 89 TEXT (EXTRACTOR_METATYPE_IMPORT_HASH, 90 "f9ade0aa18f660a34a4fa23392e21838"), 91 /* the VS_VERSIONINFO resource */ 92 TEXT (EXTRACTOR_METATYPE_FORMAT_VERSION, 93 "1.2.3.4"), 94 TEXT (EXTRACTOR_METATYPE_COMPANY, 95 "GNU libextractor"), 96 TEXT (EXTRACTOR_METATYPE_DESCRIPTION, 97 "libextractor PE test binary"), 98 TEXT (EXTRACTOR_METATYPE_SOFTWARE_VERSION, 99 "1.2.3.4"), 100 TEXT (EXTRACTOR_METATYPE_TITLE, 101 "pecoff_test"), 102 TEXT (EXTRACTOR_METATYPE_COPYRIGHT, 103 "CC0 1.0 Universal"), 104 TEXT (EXTRACTOR_METATYPE_FILENAME, 105 "pecoff_test.exe"), 106 TEXT (EXTRACTOR_METATYPE_PRODUCT_NAME, 107 "GNU libextractor test suite"), 108 TEXT (EXTRACTOR_METATYPE_PRODUCT_VERSION, 109 "5.6.7.8"), 110 MATCH (EXTRACTOR_METATYPE_ENTROPY, 111 "^2\\.[89][0-9] bits/byte \\(\\.rsrc\\)$"), 112 { 0, 0, NULL, NULL, 0, -1, 0, NULL } 113 }; 114 struct SolutionData pecoff_dll_sol[] = { 115 TEXT (EXTRACTOR_METATYPE_MIMETYPE, 116 "application/vnd.microsoft.portable-executable"), 117 TEXT (EXTRACTOR_METATYPE_FORMAT, 118 "PE32+"), 119 TEXT (EXTRACTOR_METATYPE_RESOURCE_TYPE, 120 "DLL"), 121 TEXT (EXTRACTOR_METATYPE_TARGET_ARCHITECTURE, 122 "x86-64"), 123 TEXT (EXTRACTOR_METATYPE_TARGET_OS, 124 "Windows"), 125 TEXT (EXTRACTOR_METATYPE_SUBSYSTEM, 126 "Windows GUI"), 127 TEXT (EXTRACTOR_METATYPE_MINIMUM_OS_VERSION, 128 "6.0"), 129 TEXT (EXTRACTOR_METATYPE_TOOLCHAIN, 130 "linker 14.38"), 131 TEXT (EXTRACTOR_METATYPE_ENTRY_POINT, 132 "0x00001000"), 133 TEXT (EXTRACTOR_METATYPE_BUILD_DATE, 134 "2020-09-13T12:26:40Z"), 135 TEXT (EXTRACTOR_METATYPE_SECURITY_MITIGATIONS, 136 "HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF," 137 " TERMINAL_SERVER_AWARE"), 138 /* the Rich header: the mask, then the tool records under it */ 139 TEXT (EXTRACTOR_METATYPE_BUILD_ID, 140 "rich:1a2b3c4d"), 141 TEXT (EXTRACTOR_METATYPE_TOOLCHAIN, 142 "Rich: prodID 0x0104, build 30729, count 34"), 143 TEXT (EXTRACTOR_METATYPE_TOOLCHAIN, 144 "Rich: prodID 0x00ff, build 30729, count 12"), 145 TEXT (EXTRACTOR_METATYPE_TOOLCHAIN, 146 "Rich: prodID 0x0105, build 30729, count 1"), 147 TEXT (EXTRACTOR_METATYPE_TOOLCHAIN, 148 "Rich: prodID 0x0001, build 0, count 5"), 149 /* the CodeView record, in symbol-server spelling */ 150 TEXT (EXTRACTOR_METATYPE_BUILD_ID, 151 "4C7B1E2A9F3D4B5C8E6F0A1B2C3D4E5F7"), 152 TEXT (EXTRACTOR_METATYPE_DEBUG_PATH, 153 "C:\\Users\\builder\\source\\repos\\pecoff_test" 154 "\\x64\\Release\\pecoff_test.pdb"), 155 TEXT (EXTRACTOR_METATYPE_ENTRY_COUNT, 156 "3"), 157 TEXT (EXTRACTOR_METATYPE_FILENAME, 158 "pecoff_test.dll"), 159 TEXT (EXTRACTOR_METATYPE_SIGNER, 160 "GNU libextractor test signer"), 161 MATCH (EXTRACTOR_METATYPE_ENTROPY, 162 "^7\\.[78][0-9] bits/byte \\(\\.pack\\)$"), 163 { 0, 0, NULL, NULL, 0, -1, 0, NULL } 164 }; 165 struct ProblemSet ps[] = { 166 { "testdata/pecoff_test.exe", 167 pecoff_exe_sol }, 168 { "testdata/pecoff_test.dll", 169 pecoff_dll_sol }, 170 { NULL, NULL } 171 }; 172 173 return ET_main ("pecoff", ps); 174 } 175 176 177 /* end of test_pecoff.c */