PE: handle empty import address table
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 1.5k
- Forks
- 202
- PR merge metrics
- No merged PRs in 30d
Description
This [PE file](https://www.virustotal.com/gui/file/0000bab1a3b04d3013d126e4621abfe7ec87ba0eafac01a53ac51c4db747f65a) has a valid import lookup table but the pointer to the import address table is 0x0:
goblin currently supports handling empty import lookup tables but not empty import address tables:
https://github.com/m4b/goblin/blob/9f7fb6b1d68bd28d154c9d6587c1f132ce04cf54/src/pe/import.rs#L189-L191
Could we extend goblin to handle the above case (parse synthentic entries from the import lookup table when the import address table is 0x0)?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in src/pe/import.rs around lines 189-191 and inspect how empty import lookup tables are handled. Reproduce the behavior with the linked PE file, then verify that parsing also works when the import address table pointer is 0x0 by deriving entries from the valid import lookup table.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100