From feb8faa7148537c14059487c53c326f05394d02a Mon Sep 17 00:00:00 2001 From: Ryan Mast Date: Thu, 12 Dec 2024 10:07:34 -0800 Subject: [PATCH] Fix bug resulting in not parsing all OPTIONAL_HEADER DataDirectory entries In the format for the PE optional header, the DataDirectory list has a fixed size of 16 address/size entries. Previously, an incorrect assumption was made that the list of entries is dynamic and given by OPTIONAL_HEADER.NumberOfRvaAndSizes. This resulted in only parsing the first entries in the list, which might not be the entries that are not empty. The most extreme case of this was NumberOfRvaAndSizes being 6, and the first 6 data directories were all empty, so none of the directories with actual data were parsed. --- pefile.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pefile.py b/pefile.py index f804678..b778ff7 100644 --- a/pefile.py +++ b/pefile.py @@ -3267,7 +3267,7 @@ def __parse__(self, fname, data, fast_load): ) MAX_ASSUMED_VALID_NUMBER_OF_RVA_AND_SIZES = 0x100 - for i in range(int(0x7FFFFFFF & self.OPTIONAL_HEADER.NumberOfRvaAndSizes)): + for i in range(16): if len(self.__data__) - offset == 0: break