Skip to content

Section data view disregards FileAlignment #11

@eternaleclipse

Description

@eternaleclipse

When displaying section data, PE-Bear uses IMAGE_SECTION_HEADER.PointerToRawData to find the section data in the file. In reality, when Windows loads the file, if the section file offset is not aligned to IMAGE_OPTIONAL_HEADER.FileAlignment, it will be rounded up to the next aligned address and loaded there. A malicious binary can use this inconsistency to display incorrect section data.

Btw, CFF Explorer falls for this too. IDA Pro displays a warning that it has detected a section that is not aligned and refuses to handle the section header.

Screenshot demonstrating the difference in section contents between section data in PE-Bear and what is actually loaded in memory (x64dbg):
Screenshot 2022-10-22 024856

EXE for reproduction: packed.zip

Metadata

Metadata

Assignees

Labels

No labels
No labels

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions