x64dbg/x64dbg
x64dbg
/
x64dbg
1
0
Fork 0
Code Releases 5 Activity

Add clarifying comment/TODO re: invalid RVAs to ReadExportDirectory(). Don't feed your .avi collection to this function just yet

This commit is contained in:
Mattiwatti 2018-03-18 20:46:53 +01:00 committed by Duncan Ogilvie
parent a94c250c5d
commit 9b0f9b5c59
No known key found for this signature in database
GPG Key ID: FC89E0AAA0C1AAD8
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/dbg/module.cpp
View File

@ -107,6 +107,11 @@ static void ReadExportDirectory(MODINFO & Info, ULONG_PTR FileMapVA)
Info.exports.reserve(exportDir->NumberOfFunctions);
Info.exportOrdinalBase = exportDir->Base;
// TODO: 'invalid address' below means an RVA that is obviously invalid, like being greater than SizeOfImage.
// In that case rva2offset will return a VA of 0 and we can ignore it. However the ntdll loader (and this code)
// will still crash on corrupt or malicious inputs that are seemingly valid. Find out how common this is
// (i.e. does it warrant wrapping everything in try/except?) and whether there are better solutions.
// Note that we're loading this file because the debuggee did; that makes it at least somewhat plausible that we will also survive
for(DWORD i = 0; i < exportDir->NumberOfFunctions; i++)
{
Info.exports.emplace_back();