Frank Poz

parse the .NET Directory

1

Parse the DIR_COM_DESCRIPTOR directory. It is also known as the .NET directory: http://www.ntcore.com/files/dotnetformat.htm

Parse the IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR directory. It is also known as the .NET directory: http://www.ntcore.com/files/dotnetformat.htm

meta_pe: fix rich header length check for hash calculation

9

The original Rich Signature write-up: http://www.ntcore.com/files/richsign.htm searches 400 bytes for the "Rich" string. The pefile module searches 128 bytes for the string. I have found that 128 is sometimes not...

cert.get_not_before() and cert.get_not_after() can return the string 'Bad time value', which was causing exception when attempting to parse with strptime(). The string.split()'ing on the ugly_error_string was sometimes not producing the...