Skip to content
This repository has been archived by the owner on Jul 20, 2024. It is now read-only.

Fixed a potential access violation #31

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

schen0x
Copy link

@schen0x schen0x commented Sep 8, 2023

Add an option to not parse the content of ExportedDirectory when target dll is an image, because:

  • The ExportedDirectory (VA) is an address in .rdata;
  • The address is de-referenced in the getExportedAddressTable and 3 other assembly functions;
  • parseDLL() is called on the raw_beacon_dll, which is an image;
  • However, this address may not exist on an image (because this may be a big address, but image is not loaded) thus may trigger an access violation. Specifically, when "ExportedDirectoryRVA" > "imageSize".
    (Not sure if there is a better solution)
  • The modification should not effect other code, i.e when parsing an in-memory dll; but will parse only the header when the dll is an image (probably another solution is to add auto-detection of image-only header (e.g PE\0\0) but it could be an extra point of failure?) because the data will be garbage anyway and may trigger an alarm.

@schen0x schen0x changed the title Fix a bug where img maybe accessed with VA Fix a possible access violation Sep 8, 2023
@schen0x schen0x changed the title Fix a possible access violation Fixed a possible access violation Sep 8, 2023
@schen0x schen0x changed the title Fixed a possible access violation Fixed a potential access violation Sep 8, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant