Cecil ignores PE header details when reading executables. #98
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Cecil ignores wide swathes of the PE header when reading executables, so if an executable differs even slightly from what it expects a CLR executable to look like, it chokes. In particular, this executable I'm trying to read doesn't have the expected number of data directories, so Cecil throws a pretty generic error at the end of ReadOptionalHeaders.
I think it would be worthwhile to at least pay attention to the NumberOfRvaAndSizes/numberOfDataDir flag in the header and skip the appropriate number of bytes so that you can deal with additional data directories in the executable. It would probably be good to at least read the header fields that contain size and offset information to ensure that you've got the right sizes/offsets - even if you don't use them, you can check that they match your expectations.
Please provide an example of such a PE file.
It turned out to actually be a CLR executable with a corrupted header, so I addressed the issue with the person who created the executable. Reading the right number of data directories is still a good idea, though. Do you want me to provide you with the corrupt executable, or do you not care about handling corrupt files?
Let's do the work when we'll have a valid file which Cecil can't read.