pe export table calculate wrong

[trailofbits]

pe export table calculate wrong

[mwpcheung]

I'm very sorry for the win xp sp3 ntkrnl。 my computer was injured by virus.
the krnl file is an error pe file.

[jkolek]

Ok, I will take a look.

This issue has been fixed in parse.cpp since #56. Fixed in pepy since #73 with change to #define PEPY_PARSED_GET.

[jkolek]

This issue appears when using pepy?

[jkolek]

I'm not able to reproduce the issue, dump-prog, pepy test and IDA Pro are outputting the same results to me for ntoskrnl.exe.

[mwpcheung]

the bug rehappened to me... export table calc error.
function name bool getExports(parsed_pe *p) + 211 lines

    ::uint32_t symRVA;
    if (!readDword(eatSec.sectionData, eatOff + eatIdx, symRVA)) {
      return false;
    }

    bool isForwarded =
        ((symRVA >= exportDir.VirtualAddress) &&
         (symRVA < exportDir.VirtualAddress + exportDir.Size));

    if (!isForwarded) {
      ::uint32_t symVA;
      if (p->peHeader.nt.OptionalMagic == NT_OPTIONAL_32_MAGIC) {
        symVA = symRVA + p->peHeader.nt.OptionalHeader.ImageBase;
      } else if (p->peHeader.nt.OptionalMagic == NT_OPTIONAL_64_MAGIC) {
        symVA = symRVA + p->peHeader.nt.OptionalHeader64.ImageBase;
      } else {
        return false;
      }

      exportent a;

      a.addr = symVA;
      a.symbolName = symName;
      a.moduleName = modName;
      p->internal->exports.push_back(a);

exportent.addr is 64bit uint. symVA you defined as uint32_t.
uint32t = uint32_t + 64bit imagebase. then bit lose. bug happens to windows x64 ntoskrnl.exe win10
2015 11