Scylla + Overlapped Headers

[waliedassar]

If you try to FIX DUMP an executable with the IMAGE_NT_HEADERS structure overlapping the IMAGE_DOS_HEADER i.e. the e_lfanew field has a value less than or equal to 0x38 (and of course, greater than or equal to 0x2), the resulting executable is rejected by the windows PE loader.

http://uploadpic.org...p?img=BdtSYOk9l

This is due to Scylla moving the IMAGE_NT_HEADERS at offset 0x40 without updating the "e_lfanew" field.

This was tested with Scylla v0.7 beta 7.

Best Regards

Waliedassar

Edited October 15, 2012 by waliedassar

[LCF-AT]

@ waliedassar

Wow!You can find a lot of bugs.

You seem to be the Indiana Jones of RCE.

greetz

[Aguila]

thank you very much waliedassar.

I didn't even know that this is possible.

[waliedassar]

thank you very much waliedassar.

I didn't even know that this is possible.

Files packed with Spack (by Bagie) used to have overlapped headers.

[waliedassar]

Here is a simple executable you can use to test Scylla.
/>http://goo.gl/UlFVH

Edited October 16, 2012 by waliedassar

[mudlord]

and place where to get spack

[Nacho_dj]

Here is a simple executable you can use to test Scylla.

http://goo.gl/UlFVH

Thanks for this valuable info!

[Aguila]

I think this little fix is enough for this problem. Only 2 new lines in source code.

Thanks for your help

[vnhung]

you can upload the project source code Scylla_v0.7 beta8 thank