Posted October 15, 201212 yr If you try to FIX DUMP an executable with the IMAGE_NT_HEADERS structure overlapping the IMAGE_DOS_HEADER i.e. the e_lfanew field has a value less than or equal to 0x38 (and of course, greater than or equal to 0x2), the resulting executable is rejected by the windows PE loader.http://uploadpic.org...p?img=BdtSYOk9lThis is due to Scylla moving the IMAGE_NT_HEADERS at offset 0x40 without updating the "e_lfanew" field.This was tested with Scylla v0.7 beta 7.Best RegardsWaliedassar Edited October 15, 201212 yr by waliedassar
October 15, 201212 yr @ waliedassar Wow!You can find a lot of bugs. You seem to be the Indiana Jones of RCE. greetz
October 15, 201212 yr Author thank you very much waliedassar.I didn't even know that this is possible.Files packed with Spack (by Bagie) used to have overlapped headers.
October 16, 201212 yr Author Here is a simple executable you can use to test Scylla./>http://goo.gl/UlFVH Edited October 16, 201212 yr by waliedassar
October 17, 201212 yr Here is a simple executable you can use to test Scylla. http://goo.gl/UlFVH Thanks for this valuable info!
October 17, 201212 yr I think this little fix is enough for this problem. Only 2 new lines in source code.Thanks for your help
Create an account or sign in to comment