Vector35 / Vector35/binaryninja-api

PE files parsed incorrectly with sections that overlap

Open
#8,412 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

File Format: PE
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: 5.4.10303-dev
  • Edition: Ultimate
  • OS: macOS
  • OS Version: 26.6
  • CPU Architecture: arm64

Bug Description:
In certain PE files, parsing some of the relocation data fails due to the resource section overlapping in our binary parsing.

Steps To Reproduce:

  1. Open the binary from dogbolt with hash 215bec7e5a30eac4ff15051dac1bc2c634a48ebb4caeac6d0047e9195967889d
  2. Observe error: [BinaryView.PEView] Failed to parse relocation directory: read out of bounds
  3. Navigate to 10016160
  4. Python: bv.relocation_ranges_at(here)
  5. Rebase binary to 20000000
  6. Observe vftable pointer is not rebased properly

Expected Behavior:
I expected all of the relocations to be parsed.

Screenshots/Video Recording:
Image

Binary:
Dogbolt binary, PE/windows-x86, with hash 215bec7e5a30eac4ff15051dac1bc2c634a48ebb4caeac6d0047e9195967889d

Additional Information:
Codex says that PEView::RVAToFileOffset is incorrect and causing the binary reader to read from the rsrc section's offset when trying to read bytes from the reloc section. Codex suggested a significantly more complicated fix than I was expecting. Attempting to map an address to an RVA and vice versa is apparently much more complicated than I thought.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the mentioned PEView::RVAToFileOffset entry point and reproduce the failure with the Dogbolt binary hash 215bec7e5a30eac4ff15051dac1bc2c634a48ebb4caeac6d0047e9195967889d. Use bv.relocation_ranges_at(here) and the rebasing steps to inspect relocation parsing; done means the relocation directory parses without an out-of-bounds error and the vftable pointer rebases correctly.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
50/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.