Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix IAT Reconstruction #528

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

Catminusminus
Copy link

This will be fix #523

Currently, this->binary_->section_from_offset(offset_imports) is used as the original import section.
However, if the "backward shift" (explained in #523 ) happens, this returns the previous section of the original import section. So I try another way to obtain the original import section.

I introduce PE_SECTION_TYPES::OLD_IMPORT type to mark the original import section.
The type will be added to the target section when the PE_SECTION_TYPES::IMPORT type will be removed from it.

After adding the new import section, we can find the original import section by looking to see if the type is PE_SECTION_TYPES::OLD_IMPORT.

If we can not find the original import section, it will fall back to the current implementation, that is, this->binary_->section_from_offset(offset_imports) will be used.

macOS and iOS CI jobs currently failed, but I suspect that they are due to the GitHub Actions' issue (actions/runner-images#841).
In fact, I see the "(X) This check failed" message and these jobs are unstable...
https://github.com/Catminusminus/LIEF/actions/runs/492792964

Sorry if I my suspicions are wrong. I'll re-run the jobs to find out what's wrong, anyway.

section_from_offset(original_import_offset) can return the previous section of original import section, so use this->binary_->section_from_offset((*original_import_section)->pointerto_raw_data()) where original_import_section is corresponding to the original import section. To obtain original_import_section after adding the new import section, we introduce PE_SECTION_TYPES::OLD_IMPORT type. This type is just used to mark the original import section.
We use section_from_offset(offset_imports) as the original import section if no section has OLD_IMPORT type.
@Catminusminus
Copy link
Author

I found this PR works for C++, but doesn't work for Python API. That is, applying the following code 9 times creates an invalid PE file.

    binary = lief.PE.parse(input_path)
    binary.optional_header.dll_characteristics &= (
        ~lief.PE.DLL_CHARACTERISTICS.DYNAMIC_BASE
    )
    builder = lief.PE.Builder(binary)
    builder.build_imports(True).patch_imports(True)
    builder.build()
    builder.write(output_path)

I'm investigating this issue.

@Catminusminus
Copy link
Author

The above my comment is wrong and I conformed that this PR do work for Python API.
I'm sorry for my misunderstanding.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Reconstructing IAT many times can break PE files
1 participant