When I try to load an exe into IDApro it shows up an error:
The input file has unaligned section pointers
What does this mean ?
-
Is it an error or a warning? Does IDA fail to load the binary? In my experience, this is just an advisory message and IDA loads the binary just fine. Misaligned section pointers are used by some obfuscation utilities in an attempt to break PE analysis tools that fail to deal with them properly. IDA tends to not fall in that category.– Chris EagleMar 31, 2014 at 6:29
-
Its an warning to be correct . I guess its some kind of unknown packer . I might be wrong . But i am sure there is something the exe is trying to hide .– parthibdMar 31, 2014 at 9:54
-
Plus there is one more problem . When i try to run the binary in ollydbg it shows up the splash screen and just gets stuck there . Do you think the binary is using some anti-debugging techniques to fool olly ?– parthibdMar 31, 2014 at 10:08
Add a comment
|
1 Answer
There are alignment rules for both sections in memory and on disk. For example, PointerToRawData must be a multiple of the FileAlignment field (in the optional header, with the default being 512) and ImageBase+SectionVA must be a multiple of the SectionAlignment field (in the optional header, with the default being the page size of the architecture). SectionAlignment also must be >= FileAlignment.
-
I understood what you said . But what does this error mean in the IDA pro context ? IDA pro also says it might mean that data is hidden in some way . But I am not able to figure out what the error means.– parthibdMar 30, 2014 at 20:22
-
IDA is warning you that the input file doesn't play by the rules. IDA will try to work around the problems but it can't guarantee it. Therefore it is possible that some data wont be shown or interpreted properly. Check out TinyPE for one example of a file that runs fine (until XP) but ignores the usual PE structure.– DavidMar 31, 2014 at 8:49
-
I look like its some type of packing according to me . I got what you said . But there is one more thing . Its also shows another error " Unknown fixup type x7000is ignored " . Now what's that supposed to mean . I searched but couldn't find any satisfying answer for that . What is that error ?– parthibdMar 31, 2014 at 9:51
-
Fixup records are a 4 bit type (7 in your case) followed by a 12 bit offset. IDA is telling you fixup type 7 is not valid, and it can't load the file due to that (or at least can't apply reloc fixups).– broadwayMar 31, 2014 at 11:47
-
Thanks for the answer @broadway . But coming to my original problem it seems that the exe is not packed by any kind of packer . I triple checked it .According to you what can be the possible reason ?– parthibdMar 31, 2014 at 12:19