search

nanonyme / pefile

Automatically exported from code.google.com/p/pefile
Other
0 stars 0 forks source link

Corrupted PE not detected as such #46

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago 
What steps will reproduce the problem?
1. Create a folder called crap
2. Extract corrupted file into the crap folder
3. Run py.scan.py (attached)

What is the expected output? What do you see instead?
I expect file to be listed as corrupted, but instead it is stored for analysis

What version of the product are you using? On what operating system?
pefile-1.2.10-139
Python 2.7.6

File is definatelly corrupted
Could you please check if something can be done to detect that ?

Thanks
Momchil

Original issue reported on code.google.com by momc...@bojinov.info on 29 Jan 2014 at 12:12

Attachments:

GoogleCodeExporter commented 9 years ago 
The file seems to be truncated but some of the headers can be parsed correctly. 
pefile will always try to parse as much as possible and only fail when it's 
impossible for it to make sense of the PE file.

Problems encountered parsing the file are reported as warnings. You could call 
"get_warnings()" to retrieve the list and decide to drop the file if you judge 
that they indicate the file is corrupted for your application.
In this case there are a few warnings regarding data structures referring to 
data beyond the end of the file, those could be telltale signs that it has been 
truncated.

Original comment by ero.carr...@gmail.com on 27 Oct 2014 at 3:45