Endianness

[trailofbits]

Endianness

[dguido]

Yes, go for it.

…

-Dan (sent from my mobile)

On Apr 7, 2017, at 09:09, Jozef Kolek ***@***.***> wrote: There are TODO comments for readWord, readDword and readQword in buffer.cpp: // TODO: perform endian swap as needed I would like to implement this, if that's fine. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

[jkolek]

Being worked on in #45.

I wasn't able to find much information about PE file endianness, but here
is some information that I have found.

According to this source
https://en.wikibooks.org/wiki/X86_Disassembly/Windows_Executable_Files
the PE header signature (which is always 0x00004550 = "\0\0EP")
should indicate:
a) the file is a legitimate PE file,
b) the byte order of the file
But I wasn't able to find any other information related to the signature
and the byte ordering.

Also, in the NT file header in the Characteristics field there are some
deprecated flags:
IMAGE_FILE_BYTES_REVERSED_LO - Little endian: the least significant
bit (LSB) precedes the most significant bit (MSB) in memory. This
flag is deprecated and should be zero.
IMAGE_FILE_BYTES_REVERSED_HI - Big endian: the MSB precedes the LSB
in memory. This flag is deprecated and should be zero.
Source: Microsoft Portable Executable and Common Object File Format
Specification

But there is nothing else related to their usage, and also how these
flags are related to each other.

On this source http://www.doswin32.com/doswin32-en.txt there is a text:
1.7. If you do NOT need to load the extension DLL with your program
(to save memory and for quicker load time) you can mark your program
not to load this DLL. This is accomplished by setting
the IMAGE_FILE_BYTES_REVERSED_LO attribute (this attribute is ignored
by Win32 on x86).
NOTE: Some old linkers (Borland tlink32 version < 5.0, Watcom wlink)
always set this bit. New linkers (ilink32 from BCB >= 4, link
from VC >= 4) do not.
UniLink sets this bit if you use -ay or -aY command line switches
instead of -ax or -aX).

Which means that IMAGE_FILE_BYTES_REVERSED_LO was also used for something
else unrelated to the byte ordering.

So far I have implemented byte swapping if there is a little-endian machine
set and Characteristics flag IMAGE_FILE_BYTES_REVERSED_HI is on.