Monday, February 6, 2012

How not to write specifications.

Since my current definition of "havin' a good time" means attempting to start a native NT application in Linux, I am forced to be quite familiar with the PE-COFF format.

Needless to say, this is a poorly written specification. Here are some of the questions you won't find an answer to.
  1. Endianness of the format. Is it always little-endian? (i.e. for big-endian machines as well?). Apparently, yes.
  2. Endianness of applying the relocation records. The base relocation record is obviously LE, but what about the modified VAs? I would assume target-endianness, but this isn't actually noted.
  3. Optional header checksum: what's the actual algorithm? I mean, it can't be any more interesting than a CRC32, and an *interested party* will obviously reverse engineer this, so you can't actually think that hiding such details is a security mechanism?
  4. What is the expected result of IMAGE_REL_BASED_HIGHADJ? Community consensus implies that the high value of the 32-bit word modified needs to be sign adjusted. Why not just say that in the specification?
  5. Why not list what base relocation types apply to what architectures?
I am sure there are more...

No comments:

Post a Comment