Skip to content

[BUG][WINDOWS] Segfault on COFFSymbols & StringTable bytes exceeding memory committed size #5

@malware-unicorn

Description

@malware-unicorn

hbuf[index+pefile.FileHeader.PointerToSymbolTable] = b[index]

The combined total size of the COFFSymbols and StringTable buffers can exceed the memory committed size of the ImageSize, thus causing a sefault in trying to write to a memory location not allocated.

Tested on Win7 64bit vm on QubeOS.

Recommendation:
Instead of allocating for the total ImageSize, allocate these sections separately or adopt CopySections function from: https://github.com/fancycode/MemoryModule/blob/master/MemoryModule.c#L176

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions