I'm writing a tool, which analyses PE-Malformations and I'would like to build a function to detect a destroyed import section in a PE-File. It would be great if it would be possible to somehow figure it out from the optional header of a PE.
If I open a PE with IDA Pro then I'm notified about that:
But I'm interesting about how it works under the hood. Is IDA Pro saying that Imports are destroyed just because there are a few imports? Or does it try to find some functions and isn't able to do that?
I'm sorry if it's a simple question, but I could not find a detailed information about that. There are a lot of information how to rebuilt/repair Import Address Table from a dumped file, but not how to actually detect it by yourself. Thanks in advance!
I would like to show one example with a corrupted import sections by viewing a PE in a PEView Tool.
Below you see a PE which claims that it has the import table at the RVA 0xA21C.
BUT this file ends at the RVA 0x5BF0.
Since 0xA21C > 0x5BF0 we can conclude that the imports in this PE are damaged, because 0xA21C is a not valid pointer, right?
Are there another ways to recognise the corrupted import section?