Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

outdate load configuration structure format and parsing don`t consider actual size of structure #220

Open
zero-gear opened this issue Jan 9, 2018 · 0 comments

Comments

@zero-gear
Copy link
Contributor

zero-gear commented Jan 9, 2018

this issue contains 2 interrelated sub-issues:

  1. load configuration structure format don't correspond to latest “winnt.h”, is partial(not complete)
  2. parsing of load configuration structure disregard(ignore) its actual size defined in its 1st field 'Size'

Shortcuts used below in text:
LCD - Load Configuration Directory

1st sub-issue:
below table shows differences between LCD format in pefile and “winnt.h” from Win10 SDK.
Recently not implemented in pefile in red
format_diff_table
SOLUTION require modify 'PE.__IMAGE_LOAD_CONFIG_DIRECTORY_format__' and 'PE.__IMAGE_LOAD_CONFIG_DIRECTORY64_format__' class variables

2nd sub-issue:
For x86-64 Load Configuration Data Directory entry 'Size' field show actual size of LCD , and is equal to size of LCD reflected in its 1st field - 'Size'.
For x86-32 Load Configuration Data Directory entry 'Size' field is always equal to 64(0x40) for compatibility with Windows XP and earlier versions of Windows[proof], actual size of LCD reflected in its 1st field - 'Size'.
But 'parse_directory_load_config' method always use size of LCD implicitly implied by '__IMAGE_LOAD_CONFIG_DIRECTORY_format__' class variable, what lead sometimes to existence of redundant properties in 'pe.DIRECTORY_ENTRY_LOAD_CONFIG.struct' after parsing.
Explanation Example:
LCD format in pefile is next:

__IMAGE_LOAD_CONFIG_DIRECTORY_format__ = (
       'IMAGE_LOAD_CONFIG_DIRECTORY',
        ('I,Size',      # ! this field reflect actual size of LCD
        'I,TimeDateStamp',
        'H,MajorVersion',
        'H,MinorVersion',
        'I,GlobalFlagsClear',
        'I,GlobalFlagsSet',
        'I,CriticalSectionDefaultTimeout',
        'I,DeCommitFreeBlockThreshold',
        'I,DeCommitTotalFreeThreshold',
        'I,LockPrefixTable',
        'I,MaximumAllocationSize',
        'I,VirtualMemoryThreshold',
        'I,ProcessHeapFlags',
        'I,ProcessAffinityMask',
        'H,CSDVersion',
        'H,Reserved1',
        'I,EditList',
        'I,SecurityCookie',
        'I,SEHandlerTable',
        'I,SEHandlerCount',
        'I,GuardCFCheckFunctionPointer',
        'I,Reserved2',
        'I,GuardCFFunctionTable',
        'I,GuardCFFunctionCount',
        'I,GuardFlags' ) )

which implicitly imply that full size of LCD is 0x5c.
procexp.exe from here has:
pe.OPTIONAL_HEADER.DATA_DIRECTORY[10].Size == 0x40
pe.DIRECTORY_ENTRY_LOAD_CONFIG.struct.Size == 0x48
That means 'pe.DIRECTORY_ENTRY_LOAD_CONFIG.struct' has to have only properties that fit in its actual size:

__IMAGE_LOAD_CONFIG_DIRECTORY_format__ = ('IMAGE_LOAD_CONFIG_DIRECTORY',
        ('I,Size',      # ! in your example is equal to 0x48
        'I,TimeDateStamp',
        'H,MajorVersion',
        'H,MinorVersion',
        'I,GlobalFlagsClear',
        'I,GlobalFlagsSet',
        'I,CriticalSectionDefaultTimeout',
        'I,DeCommitFreeBlockThreshold',
        'I,DeCommitTotalFreeThreshold',
        'I,LockPrefixTable',
        'I,MaximumAllocationSize',
        'I,VirtualMemoryThreshold',
        'I,ProcessHeapFlags',
        'I,ProcessAffinityMask',
        'H,CSDVersion',
        'H,Reserved1',
        'I,EditList',
        'I,SecurityCookie',
        'I,SEHandlerTable',
        'I,SEHandlerCount',			
                   #<== 0x48 – actual size of LCD cover to this point
        'I,GuardCFCheckFunctionPointer', # redundant
        'I,Reserved2',                   # redundant
        'I,GuardCFFunctionTable',        # redundant
        'I,GuardCFFunctionCount',        # redundant
        'I,GuardFlags'                   # redundant
                   #<== 0x5c – size of LCD implied by full format cover to this point
         )
)

But after parsing there are also present properties that shouldn't be – above they are matched with comment # redundant
Bytes after LCD end(at offset greater than 0x48) are parsed too! WTF!
SOLUTION of LCD actual size overflow at parsing require changes to 'parse_directory_load_config' method. Code should do check of actual size of LCD and if it is less than full size implied by '__IMAGE_LOAD_CONFIG_DIRECTORY_format__' class variable, we need format truncation before pass it as argument to '__unpack_data__' method. For x86-64 solution is analogical.

If your have some thoughts or another vision of problem solution, please feel free to write here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant