-
Notifications
You must be signed in to change notification settings - Fork 203
Closed
Description
When displaying section data, PE-Bear uses IMAGE_SECTION_HEADER.PointerToRawData
to find the section data in the file. In reality, when Windows loads the file, if the section file offset is not aligned to IMAGE_OPTIONAL_HEADER.FileAlignment
, it will be rounded up to the next aligned address and loaded there. A malicious binary can use this inconsistency to display incorrect section data.
Btw, CFF Explorer falls for this too. IDA Pro displays a warning that it has detected a section that is not aligned and refuses to handle the section header.
Screenshot demonstrating the difference in section contents between section data in PE-Bear and what is actually loaded in memory (x64dbg):
EXE for reproduction: packed.zip
Metadata
Metadata
Assignees
Labels
No labels