When parsing a packed PE file that has malformed data directories (in my case, with UPack/WinUPack) relocate_image fails. If the PE file has no relocation directory but does have data in the relocation directory RVA/Size, you can't get the memory mapped image from the file.
if self.OPTIONAL_HEADER.DATA_DIRECTORY[5].Size:
if not hasattr(self, 'DIRECTORY_ENTRY_BASERELOC'):
self.parse_data_directories(
directories=[DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_BASERELOC']])
for reloc in self.DIRECTORY_ENTRY_BASERELOC:
If parse_data_directories fails because of junk data, nothing prevents this from hitting the exception.
Offending PE file:
Stack trace:
File "/home/alog/.local/lib/python3.6/site-packages/pefile.py", line 4268, in get_memory_mapped_image
self.relocate_image(ImageBase)
File "/home/alog/.local/lib/python3.6/site-packages/pefile.py", line 5361, in relocate_image
for reloc in self.DIRECTORY_ENTRY_BASERELOC:
AttributeError: 'PE' object has no attribute 'DIRECTORY_ENTRY_BASERELOC'
When parsing a packed PE file that has malformed data directories (in my case, with UPack/WinUPack)
relocate_image
fails. If the PE file has no relocation directory but does have data in the relocation directory RVA/Size, you can't get the memory mapped image from the file.If
parse_data_directories
fails because of junk data, nothing prevents this from hitting the exception.Offending PE file:
Stack trace: