Skip to content

PE files parsed incorrectly with sections that overlap #8412

Description

@CouleeApps

Version and Platform (required):

  • Binary Ninja Version: 5.4.10303-dev
  • Edition: Ultimate
  • OS: macOS
  • OS Version: 26.6
  • CPU Architecture: arm64

Bug Description:
In certain PE files, parsing some of the relocation data fails due to the resource section overlapping in our binary parsing.

Steps To Reproduce:

  1. Open the binary from dogbolt with hash 215bec7e5a30eac4ff15051dac1bc2c634a48ebb4caeac6d0047e9195967889d
  2. Observe error: [BinaryView.PEView] Failed to parse relocation directory: read out of bounds
  3. Navigate to 10016160
  4. Python: bv.relocation_ranges_at(here)
  5. Rebase binary to 20000000
  6. Observe vftable pointer is not rebased properly

Expected Behavior:
I expected all of the relocations to be parsed.

Screenshots/Video Recording:
Image

Binary:
Dogbolt binary, PE/windows-x86, with hash 215bec7e5a30eac4ff15051dac1bc2c634a48ebb4caeac6d0047e9195967889d

Additional Information:
Codex says that PEView::RVAToFileOffset is incorrect and causing the binary reader to read from the rsrc section's offset when trying to read bytes from the reloc section. Codex suggested a significantly more complicated fix than I was expecting. Attempting to map an address to an RVA and vice versa is apparently much more complicated than I thought.

Metadata

Metadata

Assignees

No one assigned

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions