search

mentebinaria / readpe

The PE file analysis toolkit
GNU General Public License v2.0
677 stars 128 forks source link

error too many directories #125

Open wmmw123 opened 6 years ago

wmmw123 commented 6 years ago

Hello.

If I run the file, an error occurs.

"error too many directories "

What's the reason?

Thanks.

jweyrich commented 6 years ago

The PE you're analyzing contains more than 16 directories. Most (or all) non-obscure compilers don't need more than 16 directories.

If you know how to compile pev, you may increase it in include/libpe/pe.h#L48.

We might want to increase it for the next version. Not sure if it makes sense to support the entire range supported by the 4 bytes of NumberOfRvaAndSizes though. That would be 65535 directories.

GoGoOtaku commented 1 year ago

This has been bugging me for months now and countless searching for a mythical valid PE file that somehow has more than 16 directories has not yielded anything.

Data directories are used by the windows loader and all have highly specific purposes. (e.g. Export, Imports, .NET stuff ) I frankly don't understand why an executable would even have more than 16 directories - the PE loader would not use it anyway. In fact the 16th directory is currently not even used for anything so it really doesn't even make real world sense to use more than 15. The final nail in the coffin (pun not intended) for windows is that the NT headers define a maximum of 16 directories and afaik this has not changed.

Outside of windows only windows compatibles (ReactOS, Wine, PE LoadLibrary) and UEFI are using PE. The first ones obviously can't change anything and the second one should only differ in the subsystem.

So what I am trying to say: I don't get it and I really would like to see a PE file with more than 16 directories.