m4b / m4b/goblin

PE: meet invalid name rva in ImportDirectoryEntry and panic

Open
#181 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
1.5k
Forks
202
PR merge metrics
No merged PRs in 30d

Description

I have met some nasty exe that have a invalid .idata section, which will panic.
Something like:

thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: Malformed("Cannot find name from rva 0x43720004 in sections ...

code: https://github.com/m4b/goblin/blob/master/src/pe/import.rs#L147-L148

In this moment i actually don't know why these exe have such .idata. I just want to parse the unwind info.
Now pe::PE::parse will parse the whole pefile.
I am wondering would it be nice to pass some options to enable/disable parse partially.
Like i would disable parsing the import table as i just want to get the exception table (for the unwind info).

BTW, i use gimli/object to help parsing object files. Thanks for the great job.
I don't know where i should fire this issue (goblin or gimli/object?)

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with src/pe/import.rs around lines 147-148 and trace how PE::parse reaches the ImportDirectoryEntry name lookup. Reproduce the panic with the malformed .idata input described in the issue, then determine how parsing should handle the invalid RVA while still allowing exception-table or unwind-info parsing; no test file is named in the report.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.