Skip to content

Does not parse Debug directory as array of debug entries #15

@Lima-X

Description

@Lima-X

pe bear seems to interpret the debug directory as a single entry, when in reality its a array who's size is determined by the size in the optional header debug data directory
this is part of the spec as mentioned here https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#debug-directory-image-only\
> Image files contain an optional debug directory that indicates what form of debug information is present and where it is. This directory consists of an array of debug directory entries whose location and size are indicated in the image optional header.

image
the blue bytes represent the codeview directory which is usually the first and is parsed, the binary from the example has 2 additional entries it misses here marked red.

this is rather not critical but just a small oversight, would be nice as an enhancement tho

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions