PE: parser hangs while processing corkami's `manyimportsW7.exe`
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 1.5k
- Forks
- 202
- PR merge metrics
- No merged PRs in 30d
Description
Current version of goblin hangs on parsing corkami's manyimportsW7.exe , which is described as:
W7-only binary use the
TLS AddressOfIndextrick to clean its imports. On disk, the import table is full of bogus descriptors, which will be ignored on loading
Snippet to reproduce this behavior:
use std::fs;
use goblin::pe::options::ParseOptions;
use goblin::pe::options::ParseMode;
use goblin::pe;
fn main() {
let path = "manyimportsW7.exe";
let content = fs::read(path).unwrap();
let mut parse_options = ParseOptions::default();
parse_options.parse_mode = ParseMode::Permissive;
let pe_file = pe::PE::parse_with_opts(&content, &parse_options).unwrap();
}
Other PE parsers, for example pedump catch this trick:
[!] catched the 'imports terminator in TLS trick'
Taking into account, this sample is valid and somewhat popular with the community (as it is supported by other PE parsers, etc), it would be nice to catch fake imports usage in order not to load them all.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the reproduced call to pe::PE::parse_with_opts using ParseMode::Permissive and the corkami manyimportsW7.exe sample. Trace PE import parsing and compare the TLS AddressOfIndex trick with the pedump behavior described in the issue. Done means parsing terminates and bogus import descriptors are not loaded for this valid sample.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100