64 bit import thunks, cross section RVAs in import table

sashs / filebytes

Library to read and edit files in the following formats: Executable and Linking Format (ELF), Portable Executable (PE), MachO and OAT (Android Runtime)

https://scoding.de/filebytes-introduction

BSD 3-Clause "New" or "Revised" License

126 stars 25 forks source link

64 bit import thunks, cross section RVAs in import table #33

Closed sevaa closed 2 months ago

sevaa commented 2 months ago

Addresses the issues uncovered by the binary in https://github.com/sevaa/dwex/issues/57 :

in PE32+, the thunks in the import lookup/address tables are 64 bit
the RVAs in the import table (both import directory and thunks) may be cross section
also, there are more 64 bit architectures than AMD64

The PE format reference doc I went by is here.

Windows Defender might complain the binary contains a virus. Nothing wrong with that binary as far as I could see.

sashs commented 2 months ago

Merged! Many thx!

sevaa commented 2 months ago

Thanks. Another one coming.