Proposals / #674

Type WARDEN_VerifyModuleSignature’s module input as bytes

applied · by Commit-Will · submitted 2026-11-01, applied 2026-11-01

Ghidra v1797 · 3bccb89

Stack8 pData is an allocated module-byte buffer. Sole caller allocates nSize bytes, copies the source into them, RC4-decrypts individual bytes in place, and PUSH ESI at0x0047fd46 passes the unchanged allocation base to this verifier. Complete408-byte verifier adds byte offsets to that base for the signature marker and signature payload, passes them to SMemCopy, and forwards the unchanged base in EBX to the hash helper’s existing uint8_t* pModuleData slot. Complete target/caller/allocator/copy/RC4/hash byte ranges were checked against the original Windows PE; CFG confirms the sole buffer definition reaching the call. Retype only existing pData int32_t to uint8_t*, preserving its name, BOOL return, convention, all eight formal positions and custom ECX/EAX inputs. Prior#629 targets only the separate hash-output helper; no pending function is edited. No runtime or byte-match benefit is claimed.

Changes 1, applied together

1. Retype variable win 0x0047fa20 Stack[0x8]

   typeint32_t→uint8_t *