erocarrera / pefile

pefile is a Python module to read and work with PE (Portable Executable) files
MIT License
1.88k stars 522 forks source link

AttributeError: 'PE' object has no attribute 'DIRECTORY_ENTRY_BASERELOC' #268

Open ajlogsdon opened 5 years ago

ajlogsdon commented 5 years ago

When parsing a packed PE file that has malformed data directories (in my case, with UPack/WinUPack) relocate_image fails. If the PE file has no relocation directory but does have data in the relocation directory RVA/Size, you can't get the memory mapped image from the file.

        if self.OPTIONAL_HEADER.DATA_DIRECTORY[5].Size:
            if not hasattr(self, 'DIRECTORY_ENTRY_BASERELOC'):
                self.parse_data_directories(
                    directories=[DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_BASERELOC']])
            for reloc in self.DIRECTORY_ENTRY_BASERELOC:

If parse_data_directories fails because of junk data, nothing prevents this from hitting the exception.

Offending PE file: image

Stack trace:

  File "/home/alog/.local/lib/python3.6/site-packages/pefile.py", line 4268, in get_memory_mapped_image
    self.relocate_image(ImageBase)
  File "/home/alog/.local/lib/python3.6/site-packages/pefile.py", line 5361, in relocate_image
    for reloc in self.DIRECTORY_ENTRY_BASERELOC:
AttributeError: 'PE' object has no attribute 'DIRECTORY_ENTRY_BASERELOC'
deFr0ggy commented 2 years ago

You can try doing the exception handling for this one!