-
Notifications
You must be signed in to change notification settings - Fork 204
Description
pe bear seems to interpret the debug directory as a single entry, when in reality its a array who's size is determined by the size in the optional header debug data directory
this is part of the spec as mentioned here https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#debug-directory-image-only\
> Image files contain an optional debug directory that indicates what form of debug information is present and where it is. This directory consists of an array of debug directory entries whose location and size are indicated in the image optional header.
the blue bytes represent the codeview directory which is usually the first and is parsed, the binary from the example has 2 additional entries it misses here marked red.
this is rather not critical but just a small oversight, would be nice as an enhancement tho