2

I'm writing a tool, which analyses PE-Malformations and I'would like to build a function to detect a destroyed import section in a PE-File. It would be great if it would be possible to somehow figure it out from the optional header of a PE.

If I open a PE with IDA Pro then I'm notified about that:

But I'm interesting about how it works under the hood. Is IDA Pro saying that Imports are destroyed just because there are a few imports? Or does it try to find some functions and isn't able to do that?

I'm sorry if it's a simple question, but I could not find a detailed information about that. There are a lot of information how to rebuilt/repair Import Address Table from a dumped file, but not how to actually detect it by yourself. Thanks in advance!

-------little supplement-------------

I would like to show one example with a corrupted import sections by viewing a PE in a PEView Tool.

Below you see a PE which claims that it has the import table at the RVA 0xA21C.

BUT this file ends at the RVA 0x5BF0.

Since 0xA21C > 0x5BF0 we can conclude that the imports in this PE are damaged, because 0xA21C is a not valid pointer, right?

Are there another ways to recognise the corrupted import section?

Improve this question
4
  • I answered your first question below. Please ask your second question in a separate post. (One question per post, please.)
    – Jason Geffner
    Feb 11, 2016 at 14:42
  • This is one question, but with an example.
    – 0xDEADC0DE
    Feb 11, 2016 at 14:46
  • You're asking how IDA Pro decides whether or not to display its imports segment warning message, and you're also asking for other ways to recognize a corrupted import section.
    – Jason Geffner
    Feb 11, 2016 at 15:04
  • I'm actually asking how to detect a corrupted import section. The case with IDA Pro is another example - I want to understand how IDA Pro detects a damaged IAT too.
    – 0xDEADC0DE
    Feb 11, 2016 at 15:19

2 Answers 2

Reset to default
3

You need to get familiar with PE Import Table

In a nutshell (I will not mention about import by ordinal)

IMAGE_IMPORT_DESCRIPTOR.FirstThunk points to IMAGE_IMPORT_BY_NAME table. 

IMAGE_IMPORT_DESCRIPTOR.FirstThunk --------------------------
                                                            |
                                                            |
IMAGE_IMPORT_BY_NAME <---------------------------------------
IMAGE_IMPORT_BY_NAME
IMAGE_IMPORT_BY_NAME
IMAGE_IMPORT_BY_NAME

When you parse the table and it's pointers (RVA) are not resolved to a valid IMAGE_IMPORT_BY_NAME structure you can assume import table is corrupted.

Improve this answer
4
  • Thank you! I have also added an example to my question. Do I understand it correctly?
    – 0xDEADC0DE
    Feb 11, 2016 at 14:30
  • I dont use use PEView tool I use/recommend CFF explorer ntcore.com/exsuite.php Looking at the screenshot your file has import table at RVA 0xA21C it is not an offset.
    – krusty
    Feb 11, 2016 at 14:39
  • But is it a correct logic in this example?
    – 0xDEADC0DE
    Feb 11, 2016 at 14:52
  • Yes of course if Import Table RVA is not valid (outside of the file) then import table is corrupted. But that's the first step to validate import table. The stuff I described is deeper, it's not that simple.
    – krusty
    Feb 11, 2016 at 15:00
1

But I'm interesting about how it works under the hood.

IDA shows that message if the PE section that contains the Import Table doesn't contain relocations and the name of Import Table's section isn't one of the following: .idata, .rdata, .text.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.