CVE-2021-1647 discrepancy between writeup and cited example

[googleprojectzero]

CVE-2021-1647 discrepancy between writeup and cited example

[maddiestone]

I could have been more descriptive, but the "sections" mentioned aren't the PE header sections, but the sections processed when unpacking ASProtect. I believe they might be in the IAT table, but I could be misremembering.

[9293746]

(Sample's Sections data for reference, since I didn't realize I could upload pictures:

)

It seems unlikely that the "sections" would have referred to the IAT, since 1) there's specifically a portion of the headers called "sections" which have page-aligned sizes like were mentioned and 2) import addresses are fixed size and thus have no need for a page-sized field in the IAT. (See https://opensecuritytraining.info/LifeOfBinaries_files/2012_LifeOfBinaries2.0.pdf slide 67 and beyond).

On the off chance that you meant the RVA/Sizes e.g. pointing at the IAT section in the OptionalHeader.DataDirectory, I checked that too, and that also doesn't have the specified sizes appearing anywhere

[9293746]

Out of curiosity I was wondering if ASProtect had some sort of special embedded metadata it used instead of just expecting the executable loader to do its job for it, so I googled how ASProtect works, and came up with this, which shows a .aspack and .adata section within the section headers: https://martinosani.it/2020/02/aspack-manual-unpacking.html (another citation for that expectation here)
The lack of a .aspack or .adata section in the sample makes me suspicious that it's just an issue that the cited sample isn't really ASProtected? Do you think you could re-find the sample you analyzed?

[maddiestone]

I've confirmed that the sample (6e1e9fa0334d8f1f5d0e3a160ba65441f0656d1f1c99f8a9f1ae4b1b1bf7d788) is correct for the write-up. If you hook up a debugger to mpengine while scanning the sample, you'll see that after running CAsprotectDLLAndVersion::Unpack within CAsprotectDLLAndVersion::RetrieveVersionInfoAndCreateObjects, the sections and sizes are [(0,0), (0,0), (0,2000), (2000,3000)]. Since the values are populated by the Unpack() function, it's probably safe to say there's something custom going on, but I didn't reverse Unpack().