jonnyzzz/PE — pull request #2 by douggard (2014-07-31 04:35:43+00:00)
Title: Fixed off by 32 bug on ImageDataDirectory parsing. Added test.

Changed one variable name id to ide. There are still two id variables in that file for ImageData and ImportDirectory.

The 32 bytes are probably the section header size minus the name. The address retrieved (vad) must be pointing at the end of the section header because this fix is equivalent to doing vad -= 32. I would have done the fix by adjusting vad, however, the getVirtualSize that is used to calculate vex may also be size from the end of header. So in order to not break the range check, the adjustment is done after.

The test walks the imported library names and prints them. Output is:

KERNEL32.dll
USER32.dll
COMCTL32.dll
MSVCRT.dll

The test file used is named the sha256 for easy lookup, but it is some copy of Eclipse 4.4.