Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

PE-bear hangs on loading PE (Corkami: manyimportsW7) #23

Closed
greenozon opened this issue Mar 15, 2023 · 6 comments
Closed

PE-bear hangs on loading PE (Corkami: manyimportsW7) #23

greenozon opened this issue Mar 15, 2023 · 6 comments
Assignees
@hasherezade
Labels
bug Something isn't working

Comments

@greenozon
Copy link

Version used:
image

Looks like it is super memory hungry while loading this PE
it can't stop and eats all the RAM...
eg:
image

PE:
pe-hangs.zip
@hasherezade
Copy link
Owner

hi @greenozon ! thank you for reporting, I will check it and fix soon

@hasherezade
Copy link
Owner

ok, I see why it gets stuck - the Import Table is really big, and contains a lot of nonsensical entries:

imports

PE-bear tries to parse each of them, rather than just discarding them.

@greenozon
Copy link
Author

Good catch!
time for party now 👍

hasherezade added a commit that referenced this issue Mar 15, 2023
@hasherezade
Updated bearparser with a fix: Import Entries: set limit for invalid …
9d9b184 
…entries that are going to be parsed (Issue #23)
@hasherezade
Copy link
Owner

@greenozon - I fixed it, the new build is gonna be available at AppVeyor soon: https://github.com/hasherezade/pe-bear#builds
Please check it out and let me know if everything is ok.

@hasherezade hasherezade self-assigned this Mar 15, 2023
@hasherezade hasherezade added the bug Something isn't working label Mar 15, 2023
@hasherezade
Copy link
Owner

BTW - where is this binary from? what is the license? I wonder if I can add it to my repository of testcases...

@greenozon
Copy link
Author

Thank you for a super quick fix!, all is fine, app is not RAM greedy anymore and behaves very well :)
image

feel free to add as TC to your collection

@hasherezade hasherezade changed the title PE-bear hangs on loading PE PE-bear hangs on loading PE (Corkami: manyimportsW7) Mar 16, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@hasherezade hasherezade

Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@greenozon @hasherezade