Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PE: meet invalid name rva in ImportDirectoryEntry and panic #181

Open
wyxloading opened this issue Aug 18, 2019 · 3 comments
Open

PE: meet invalid name rva in ImportDirectoryEntry and panic #181

wyxloading opened this issue Aug 18, 2019 · 3 comments

Comments

@wyxloading
Copy link
Contributor

I have met some nasty exe that have a invalid .idata section, which will panic.
Something like:

thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: Malformed("Cannot find name from rva 0x43720004 in sections ...

code: https://github.com/m4b/goblin/blob/master/src/pe/import.rs#L147-L148

In this moment i actually don't know why these exe have such .idata. I just want to parse the unwind info.
Now pe::PE::parse will parse the whole pefile.
I am wondering would it be nice to pass some options to enable/disable parse partially.
Like i would disable parsing the import table as i just want to get the exception table (for the unwind info).

BTW, i use gimli/object to help parsing object files. Thanks for the great job.
I don't know where i should fire this issue (goblin or gimli/object?)

@wyxloading
Copy link
Contributor Author

I think this issue more like discussion #120 (comment). That's what i want.

@philipc
Copy link
Collaborator

philipc commented Aug 19, 2019

How sure are you that the .idata section is invalid? Can you provide the binary?

I think we shouldn't fail for this error though, so if you can fix it to at least keep going then that'd be great.

Partial parsing would be a larger change, and is not something I want to comment on at this time, but maybe others have thoughts on that.

@wyxloading
Copy link
Contributor Author

I looked into the .idata section, think it's not stick to what pe format has wrote.
But llvm just skip all the import table entries if meet any entry without an valid rva.

Anyway, here the sample exe
xy2.zip

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants