PEExplorerV2 Exports Parse Fault

In the PEParser.cpp line: 120. When you parse Forward Name. The condition judgement should use RVA directly rather than File Offset. :-)

Feb 11 '21 02:02 BeneficialCode

Will check, thanks!

Feb 11 '21 09:02 zodiacon

Can you share which binary caused a fault?

Feb 11 '21 09:02 zodiacon

Can you share which binary caused a fault? Here you are. kernel32.zip

Feb 15 '21 04:02 BeneficialCode

I don't get any exception. Are you sure you are using the latest release? I just updated in the releases to v2.03. This was also available under the AllTools repo.

Feb 15 '21 10:02 zodiacon

I don't get any exception. Are you sure you are using the latest release? I just updated in the releases to v2.03. This was also available under the AllTools repo. Yes,I'm sure.Do you see some strange address in col 2? Like LocalAlloc、VirtualAlloc and so on. The reason why this happened is that your forward name parse fault. You should resolve the problem by fixing up code in GetExports function. //auto offset = RvaToFileOffset(address); if (address > dir->VirtualAddress && address < dir->VirtualAddress + dir->Size) { symbol.ForwardName = (PCSTR)GetAddress(address); } Do not use the offset.

Feb 16 '21 04:02 BeneficialCode

bug

Something wrong :(

Apr 07 '21 14:04 BeneficialCode

Will look into it, very weird, as these are supposed to be formatted as numbers.

Apr 07 '21 16:04 zodiacon