search

JusticeRage / Manalyze

A static analyzer for PE executables.
GNU General Public License v3.0
1.01k stars 160 forks source link

Infinite loop when parsing resources #31

Closed bennw closed 6 years ago

bennw commented 6 years ago

manalyze_infloop.zip

CAUTION: malware attached

The file in the attached zip gives an infinite loop when parsing resources, spamming the following error messages:

[*] Warning: The PE contains duplicate resources. It was almost certainly crafted manually.
[*] Warning: Could not locate the section containing resource 65280. Trying to use the RVA as an offset...
[*] Warning: Resource 65280 has a size of 0!

Seems to be related to size 0 resources.

JusticeRage commented 6 years ago

Hi! Thanks a lot for the report! I'm a little busy at the moment but I'll look into this file ASAP!

JusticeRage commented 6 years ago

I've started looking into this issue. I can confirm that it takes place during the parsing of the resources, but at the moment I'm not sure that there is indeed an infinite loop taking place. It could be that parsing so many resources and printing out all the warnings takes a very long time. Either way, something needs to be done about it!

bennw commented 6 years ago

Thanks for looking into it! If it helps, at some point during the parsing, the resource number goes to 0:

[*] Warning: The PE contains duplicate resources. It was almost certainly crafted manually.
[*] Warning: Could not locate the section containing resource . Trying to use the RVA as an offset...
[*] Warning: Resource 0 has a size of 0!

I've been running the parser; as of now, the printed warnings are 107 GB in size (and counting!)

JusticeRage commented 6 years ago

Integer overflow on the number of resources? I'll be sure to keep that in mind. On my end, I've launched the parser with all messages disabled hoping that I'll be able to reach the end of the analysis!

JusticeRage commented 6 years ago

Okay, Manalyze has been running for weeks on your sample and still doesn't show any signs of stopping. I'm revising my initial judgement: you may have been right that the program somehow enters an infinite loop. I'll keep investigating this issue!