You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
load configuration structure format don't correspond to latest “winnt.h”, is partial(not complete)
parsing of load configuration structure disregard(ignore) its actual size defined in its 1st field 'Size'
Shortcuts used below in text: LCD - Load Configuration Directory
1st sub-issue:
below table shows differences between LCD format in pefile and “winnt.h” from Win10 SDK.
Recently not implemented in pefile in red SOLUTION require modify 'PE.__IMAGE_LOAD_CONFIG_DIRECTORY_format__' and 'PE.__IMAGE_LOAD_CONFIG_DIRECTORY64_format__' class variables
2nd sub-issue:
For x86-64 Load Configuration Data Directory entry 'Size' field show actual size of LCD , and is equal to size of LCD reflected in its 1st field - 'Size'.
For x86-32 Load Configuration Data Directory entry 'Size' field is always equal to 64(0x40) for compatibility with Windows XP and earlier versions of Windows[proof], actual size of LCD reflected in its 1st field - 'Size'.
But 'parse_directory_load_config' method always use size of LCD implicitly implied by '__IMAGE_LOAD_CONFIG_DIRECTORY_format__' class variable, what lead sometimes to existence of redundant properties in 'pe.DIRECTORY_ENTRY_LOAD_CONFIG.struct' after parsing. Explanation Example: LCD format in pefile is next:
__IMAGE_LOAD_CONFIG_DIRECTORY_format__= (
'IMAGE_LOAD_CONFIG_DIRECTORY',
('I,Size', # ! this field reflect actual size of LCD'I,TimeDateStamp',
'H,MajorVersion',
'H,MinorVersion',
'I,GlobalFlagsClear',
'I,GlobalFlagsSet',
'I,CriticalSectionDefaultTimeout',
'I,DeCommitFreeBlockThreshold',
'I,DeCommitTotalFreeThreshold',
'I,LockPrefixTable',
'I,MaximumAllocationSize',
'I,VirtualMemoryThreshold',
'I,ProcessHeapFlags',
'I,ProcessAffinityMask',
'H,CSDVersion',
'H,Reserved1',
'I,EditList',
'I,SecurityCookie',
'I,SEHandlerTable',
'I,SEHandlerCount',
'I,GuardCFCheckFunctionPointer',
'I,Reserved2',
'I,GuardCFFunctionTable',
'I,GuardCFFunctionCount',
'I,GuardFlags' ) )
which implicitly imply that full size of LCD is 0x5c. procexp.exe from here has:
pe.OPTIONAL_HEADER.DATA_DIRECTORY[10].Size == 0x40
pe.DIRECTORY_ENTRY_LOAD_CONFIG.struct.Size == 0x48
That means 'pe.DIRECTORY_ENTRY_LOAD_CONFIG.struct' has to have only properties that fit in its actual size:
__IMAGE_LOAD_CONFIG_DIRECTORY_format__= ('IMAGE_LOAD_CONFIG_DIRECTORY',
('I,Size', # ! in your example is equal to 0x48'I,TimeDateStamp',
'H,MajorVersion',
'H,MinorVersion',
'I,GlobalFlagsClear',
'I,GlobalFlagsSet',
'I,CriticalSectionDefaultTimeout',
'I,DeCommitFreeBlockThreshold',
'I,DeCommitTotalFreeThreshold',
'I,LockPrefixTable',
'I,MaximumAllocationSize',
'I,VirtualMemoryThreshold',
'I,ProcessHeapFlags',
'I,ProcessAffinityMask',
'H,CSDVersion',
'H,Reserved1',
'I,EditList',
'I,SecurityCookie',
'I,SEHandlerTable',
'I,SEHandlerCount',
#<== 0x48 – actual size of LCD cover to this point'I,GuardCFCheckFunctionPointer', # redundant'I,Reserved2', # redundant'I,GuardCFFunctionTable', # redundant'I,GuardCFFunctionCount', # redundant'I,GuardFlags'# redundant#<== 0x5c – size of LCD implied by full format cover to this point
)
)
But after parsing there are also present properties that shouldn't be – above they are matched with comment # redundant
Bytes after LCD end(at offset greater than 0x48) are parsed too! WTF! SOLUTION of LCD actual size overflow at parsing require changes to 'parse_directory_load_config' method. Code should do check of actual size of LCD and if it is less than full size implied by '__IMAGE_LOAD_CONFIG_DIRECTORY_format__' class variable, we need format truncation before pass it as argument to '__unpack_data__' method. For x86-64 solution is analogical.
If your have some thoughts or another vision of problem solution, please feel free to write here.
The text was updated successfully, but these errors were encountered:
this issue contains 2 interrelated sub-issues:
Shortcuts used below in text:
LCD - Load Configuration Directory
1st sub-issue:

below table shows differences between LCD format in pefile and “winnt.h” from Win10 SDK.
Recently not implemented in pefile in red
SOLUTION require modify 'PE.__IMAGE_LOAD_CONFIG_DIRECTORY_format__' and 'PE.__IMAGE_LOAD_CONFIG_DIRECTORY64_format__' class variables
2nd sub-issue:
For x86-64 Load Configuration Data Directory entry 'Size' field show actual size of LCD , and is equal to size of LCD reflected in its 1st field - 'Size'.
For x86-32 Load Configuration Data Directory entry 'Size' field is always equal to 64(0x40) for compatibility with Windows XP and earlier versions of Windows[proof], actual size of LCD reflected in its 1st field - 'Size'.
But 'parse_directory_load_config' method always use size of LCD implicitly implied by '__IMAGE_LOAD_CONFIG_DIRECTORY_format__' class variable, what lead sometimes to existence of redundant properties in 'pe.DIRECTORY_ENTRY_LOAD_CONFIG.struct' after parsing.
Explanation Example:
LCD format in pefile is next:
which implicitly imply that full size of LCD is 0x5c.
procexp.exe from here has:
pe.OPTIONAL_HEADER.DATA_DIRECTORY[10].Size == 0x40
pe.DIRECTORY_ENTRY_LOAD_CONFIG.struct.Size == 0x48
That means 'pe.DIRECTORY_ENTRY_LOAD_CONFIG.struct' has to have only properties that fit in its actual size:
But after parsing there are also present properties that shouldn't be – above they are matched with comment
# redundant
Bytes after LCD end(at offset greater than 0x48) are parsed too! WTF!
SOLUTION of LCD actual size overflow at parsing require changes to 'parse_directory_load_config' method. Code should do check of actual size of LCD and if it is less than full size implied by '__IMAGE_LOAD_CONFIG_DIRECTORY_format__' class variable, we need format truncation before pass it as argument to '__unpack_data__' method. For x86-64 solution is analogical.
If your have some thoughts or another vision of problem solution, please feel free to write here.
The text was updated successfully, but these errors were encountered: