PE: meet invalid name rva in ImportDirectoryEntry and panic
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 1.5k
- Forks
- 202
- PR merge metrics
- No merged PRs in 30d
Description
I have met some nasty exe that have a invalid .idata section, which will panic.
Something like:
thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: Malformed("Cannot find name from rva 0x43720004 in sections ...
code: https://github.com/m4b/goblin/blob/master/src/pe/import.rs#L147-L148
In this moment i actually don't know why these exe have such .idata. I just want to parse the unwind info.
Now pe::PE::parse will parse the whole pefile.
I am wondering would it be nice to pass some options to enable/disable parse partially.
Like i would disable parsing the import table as i just want to get the exception table (for the unwind info).
BTW, i use gimli/object to help parsing object files. Thanks for the great job.
I don't know where i should fire this issue (goblin or gimli/object?)
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with src/pe/import.rs around lines 147-148 and trace how PE::parse reaches the ImportDirectoryEntry name lookup. Reproduce the panic with the malformed .idata input described in the issue, then determine how parsing should handle the invalid RVA while still allowing exception-table or unwind-info parsing; no test file is named in the report.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100