Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Invalid RVA to raw conversion #49

Closed
hasherezade opened this issue Aug 30, 2022 · 1 comment
Closed

Invalid RVA to raw conversion #49

hasherezade opened this issue Aug 30, 2022 · 1 comment
Assignees
@hasherezade
Labels
bug

Comments

@hasherezade
Copy link
Owner

hasherezade commented Aug 30, 2022 •
edited
Loading

Sample:

The sample is packed with Enigma protector, and has atypical sections alignment.

The fork of bearparser used in PE-bear does incorrect conversion of addresses (from RVA to raw), causing the data directories to not be correctly resolved.

wrong_imports

Such problem does not occur in the official version of bearparser, which validly resolves addresses, and i.e. is able to display the imports:

imports_table1

The same bug is present since early versions of PE-bear. (One more reason for switching to the new bearparser ).
@hasherezade hasherezade self-assigned this Aug 30, 2022
@hasherezade
Copy link
Owner Author

Fixed in the release 0.6.0

pebear_fixed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@hasherezade hasherezade

Labels
bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@hasherezade