Skip to content

Handle "empty" sections with raw pointer and size set to 0x0 #1

@matouskozak

Description

@matouskozak

Problem with the case where a section only has a virtual size and virtual address, but the raw data pointer and raw data size are set to 0x0. The function returns a lot of free space, so it removes a lot of important parts of the binary.

def get_available_space_size(pe, section_idx):
num_sections = len(pe.sections)
if section_idx >= num_sections:
return 0
section = pe.sections[section_idx]
available_space_size = 0
# Last section
if section_idx == num_sections - 1:
overlay_offset = pe.get_overlay_data_start_offset()
if overlay_offset == None:
available_space_size = section.SizeOfRawData - section.Misc_VirtualSize
else:
available_space_size = overlay_offset - section.PointerToRawData - section.Misc_VirtualSize
else:
available_space_size = pe.sections[section_idx + 1].PointerToRawData - section.PointerToRawData - section.Misc_VirtualSize
return available_space_size

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions