Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

BadImageFormatException for import symbols #431

Closed
Avroke opened this issue May 4, 2023 · 3 comments
Closed

BadImageFormatException for import symbols #431

Avroke opened this issue May 4, 2023 · 3 comments
Labels
bug pe Issues related to AsmResolver.PE
Milestone

Comments

@Avroke
Copy link

Avroke commented May 4, 2023

AsmResolver Version

5.2.0

.NET Version

.NET 4.8

Operating System

Windows

Describe the Bug

All PE files packed or unpacked by the UPX tool make it impossible for AsmResolver to read the import symbols, because the BadImageFormatException is thrown.

As with the official Mozilla Firefox installer, downloadable at this link: Firefox Installer.exe

How To Reproduce

A simple code which should normally list the imports:

IPEImage peImage = PEImage.FromFile("Firefox Installer.exe");
foreach (var import in peImage.Imports)
{
     foreach (var symbol in import.Symbols) //The exception is here.
     {
          Console.WriteLine(import.Name + "!" + symbol.Name);
     }
}

Expected Behavior

It should be possible to parse the import symbols for this type of PE. Secana's PeNet library does it, with this simple code:

PeNet.PeFile peFile = new PeNet.PeFile("Firefox Installer.exe");
foreach (var import in peFile.ImportedFunctions)
{
    Console.WriteLine(import.DLL + "!" + import.Name);
}

The expected result:

KERNEL32.DLL!LoadLibraryA
KERNEL32.DLL!ExitProcess
KERNEL32.DLL!GetProcAddress
KERNEL32.DLL!VirtualProtect

Actual Behavior

The System.BadImageFormatException : 'Imported module "KERNEL32.DLL" has an invalid import lookup thunk table RVA.' is thrown as soon as the Symbols method of an ImportedModule is called.

Additional Context

No response

@Avroke Avroke added the bug label May 4, 2023
@Washi1337 Washi1337 added the pe Issues related to AsmResolver.PE label May 4, 2023
@Washi1337 Washi1337 added this to the 5.3.0 milestone May 4, 2023
@Washi1337
Copy link
Owner

Thanks for reporting. A potential fix has been pushed to PR #432. Could you please verify that this indeed solves your issue? You can download the build artifacts from AppVeyor once they're done.

@Avroke
Copy link
Author

Avroke commented May 5, 2023

Hello, all works perfectly!! Thank you so much for fixing this problem so quickly, it helps me a lot.

@Avroke Avroke closed this as completed May 5, 2023
@Washi1337
Copy link
Owner

Perfect! This will then be part of 5.3.0, which I intend to push to nuget in the upcoming days.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug pe Issues related to AsmResolver.PE
Projects
None yet
Development

No branches or pull requests

2 participants