Skip to content

Commit

Permalink
fix: issue while parsing PE exports
Browse files Browse the repository at this point in the history
If OriginalFirstThunk is non-null, but the RVA can't be translated to a file offset, try using the FirstThunk instead.
  • Loading branch information
plusvic committed Mar 21, 2024
1 parent 2e0acfd commit 6922819
Show file tree
Hide file tree
Showing 3 changed files with 1,079 additions and 6 deletions.
13 changes: 7 additions & 6 deletions lib/src/modules/pe/parser.rs
Original file line number Diff line number Diff line change
Expand Up @@ -1629,14 +1629,15 @@ impl<'a> PE<'a> {
};

// Use the INT (a.k.a: OriginalFirstThunk) if it is non-zero, but
// fallback to using the IAT (a.k.a: FirstThunk) if the RVA to the
// INT is zero. That's an uncommon case, but it may happen.
// TODO: find a sample file where this happens.
let thunks = match if descriptor.import_name_table > 0 {
// fallback to using the IAT (a.k.a: FirstThunk).
let thunks = if descriptor.import_name_table > 0 {
self.data_at_rva(descriptor.import_name_table)
} else {
self.data_at_rva(descriptor.import_address_table)
} {
None
}
.or_else(|| self.data_at_rva(descriptor.import_address_table));

let thunks = match thunks {
Some(thunk) => thunk,
None => continue,
};
Expand Down
Binary file not shown.
Loading

0 comments on commit 6922819

Please sign in to comment.