williballenthin / lancelot

intel x86(-64) code analysis library that reconstructs control flow
Apache License 2.0
101 stars 12 forks source link

error: bad offset 3925504 #192

Closed williballenthin closed 1 year ago

williballenthin commented 1 year ago

https://www.virustotal.com/gui/file/0000c3dd7dd3c287e9089c25ee208ea89a83d394526fbf9a9b827cd4428cff18

2023-06-06 14:05:56 [DEBUG]  read_file: "/mnt/c/Exclusions/Downloads/0000c3dd7dd3c287e9089c25ee208ea89a83d394526fbf9a9b827cd4428cff18"
2023-06-06 14:05:56 [DEBUG]  reading file: /mnt/c/Exclusions/Downloads/0000c3dd7dd3c287e9089c25ee208ea89a83d394526fbf9a9b827cd4428cff18
2023-06-06 14:05:56 [DEBUG]  read 12057 bytes
2023-06-06 14:05:56 [ERROR]  bad offset 3925504

Caused by:
    bad offset 3925504

Stack backtrace:
   0: anyhow::error::<impl core::convert::From<E> for anyhow::Error>::from
             at /home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/anyhow-1.0.71/src/error.rs:547:25
   1: <core::result::Result<T,F> as core::ops::try_trait::FromResidual<core::result::Result<core::convert::Infallible,E>>>::from_residual
             at /rustc/ce5919fcef67103098219e1868f741e56fc90963/library/core/src/result.rs:1961:27
   2: lancelot::loader::pe::get_pe
             at ./core/src/loader/pe/mod.rs:95:14
   3: lancelot::loader::pe::load_pe
             at ./core/src/loader/pe/mod.rs:208:14
   4: lancelot::loader::pe::PE::from_bytes
             at ./core/src/loader/pe/mod.rs:60:9
   5: lancelot::workspace::workspace_from_bytes
             at ./core/src/workspace/mod.rs:394:22
   6: smoke::_main
             at ./bin/src/bin/smoke.rs:76:14
   7: smoke::main
             at ./bin/src/bin/smoke.rs:93:21
   8: core::ops::function::FnOnce::call_once
             at /rustc/ce5919fcef67103098219e1868f741e56fc90963/library/core/src/ops/function.rs:250:5
   9: std::sys_common::backtrace::__rust_begin_short_backtrace
             at /rustc/ce5919fcef67103098219e1868f741e56fc90963/library/std/src/sys_common/backtrace.rs:134:18
  10: std::rt::lang_start::{{closure}}
             at /rustc/ce5919fcef67103098219e1868f741e56fc90963/library/std/src/rt.rs:166:18
  11: core::ops::function::impls::<impl core::ops::function::FnOnce<A> for &F>::call_once
             at /rustc/ce5919fcef67103098219e1868f741e56fc90963/library/core/src/ops/function.rs:284:13
  12: std::panicking::try::do_call
             at /rustc/ce5919fcef67103098219e1868f741e56fc90963/library/std/src/panicking.rs:485:40
  13: std::panicking::try
             at /rustc/ce5919fcef67103098219e1868f741e56fc90963/library/std/src/panicking.rs:449:19
  14: std::panic::catch_unwind
             at /rustc/ce5919fcef67103098219e1868f741e56fc90963/library/std/src/panic.rs:142:14
  15: std::rt::lang_start_internal::{{closure}}
             at /rustc/ce5919fcef67103098219e1868f741e56fc90963/library/std/src/rt.rs:148:48
  16: std::panicking::try::do_call
             at /rustc/ce5919fcef67103098219e1868f741e56fc90963/library/std/src/panicking.rs:485:40
  17: std::panicking::try
             at /rustc/ce5919fcef67103098219e1868f741e56fc90963/library/std/src/panicking.rs:449:19
  18: std::panic::catch_unwind
             at /rustc/ce5919fcef67103098219e1868f741e56fc90963/library/std/src/panic.rs:142:14
  19: std::rt::lang_start_internal
             at /rustc/ce5919fcef67103098219e1868f741e56fc90963/library/std/src/rt.rs:148:20
  20: std::rt::lang_start
             at /rustc/ce5919fcef67103098219e1868f741e56fc90963/library/std/src/rt.rs:165:17
  21: main
  22: __libc_start_call_main
  23: __libc_start_main@@GLIBC_2.34
  24: _start
williballenthin commented 1 year ago

error raised from goblin:

image
williballenthin commented 1 year ago

CFF also seems to recognize this to be invalid

image image
williballenthin commented 1 year ago

not a bug: the file cannot be parsed.