m4b / m4b/goblin

PE: parser hangs while processing corkami's `manyimportsW7.exe`

Open
#523 14 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
1.5k
Forks
202
PR merge metrics
No merged PRs in 30d

Description

Current version of goblin hangs on parsing corkami's manyimportsW7.exe , which is described as:

W7-only binary use the TLS AddressOfIndex trick to clean its imports. On disk, the import table is full of bogus descriptors, which will be ignored on loading

Snippet to reproduce this behavior:

use std::fs;

use goblin::pe::options::ParseOptions;
use goblin::pe::options::ParseMode;
use goblin::pe;

fn main() {
    let path = "manyimportsW7.exe";
    let content = fs::read(path).unwrap();
    let mut parse_options = ParseOptions::default();
    parse_options.parse_mode = ParseMode::Permissive;

    let pe_file = pe::PE::parse_with_opts(&content, &parse_options).unwrap();
}

Other PE parsers, for example pedump catch this trick:

[!] catched the 'imports terminator in TLS trick'

Taking into account, this sample is valid and somewhat popular with the community (as it is supported by other PE parsers, etc), it would be nice to catch fake imports usage in order not to load them all.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the reproduced call to pe::PE::parse_with_opts using ParseMode::Permissive and the corkami manyimportsW7.exe sample. Trace PE import parsing and compare the TLS AddressOfIndex trick with the pedump behavior described in the issue. Done means parsing terminates and bogus import descriptors are not loaded for this valid sample.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.