2

When I try to load an exe into IDApro it shows up an error:

The input file has unaligned section pointers

What does this mean ?

3
  • Is it an error or a warning? Does IDA fail to load the binary? In my experience, this is just an advisory message and IDA loads the binary just fine. Misaligned section pointers are used by some obfuscation utilities in an attempt to break PE analysis tools that fail to deal with them properly. IDA tends to not fall in that category. Mar 31 '14 at 6:29
  • Its an warning to be correct . I guess its some kind of unknown packer . I might be wrong . But i am sure there is something the exe is trying to hide .
    – parthibd
    Mar 31 '14 at 9:54
  • Plus there is one more problem . When i try to run the binary in ollydbg it shows up the splash screen and just gets stuck there . Do you think the binary is using some anti-debugging techniques to fool olly ?
    – parthibd
    Mar 31 '14 at 10:08
3

There are alignment rules for both sections in memory and on disk. For example, PointerToRawData must be a multiple of the FileAlignment field (in the optional header, with the default being 512) and ImageBase+SectionVA must be a multiple of the SectionAlignment field (in the optional header, with the default being the page size of the architecture). SectionAlignment also must be >= FileAlignment.

6
  • I understood what you said . But what does this error mean in the IDA pro context ? IDA pro also says it might mean that data is hidden in some way . But I am not able to figure out what the error means.
    – parthibd
    Mar 30 '14 at 20:22
  • IDA is warning you that the input file doesn't play by the rules. IDA will try to work around the problems but it can't guarantee it. Therefore it is possible that some data wont be shown or interpreted properly. Check out TinyPE for one example of a file that runs fine (until XP) but ignores the usual PE structure.
    – David
    Mar 31 '14 at 8:49
  • I look like its some type of packing according to me . I got what you said . But there is one more thing . Its also shows another error " Unknown fixup type x7000is ignored " . Now what's that supposed to mean . I searched but couldn't find any satisfying answer for that . What is that error ?
    – parthibd
    Mar 31 '14 at 9:51
  • Fixup records are a 4 bit type (7 in your case) followed by a 12 bit offset. IDA is telling you fixup type 7 is not valid, and it can't load the file due to that (or at least can't apply reloc fixups).
    – broadway
    Mar 31 '14 at 11:47
  • Thanks for the answer @broadway . But coming to my original problem it seems that the exe is not packed by any kind of packer . I triple checked it .According to you what can be the possible reason ?
    – parthibd
    Mar 31 '14 at 12:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.