Comments (4)
xchgrbprsp
commented on September 21, 2024
1
The missing region turns out to be the entire last section and I got this warning in the output:
"Large section size for section 10 of 0x1649000 being truncated to 0x1648800 to fit within the image size. This could be as a result of a custom code to load a library by means other than LoadLibrary()."
I added some printfs in the function process_disk_image in pe_header.cpp and messed around with the code a bit and found out the problem seemed to be that larger_image_size was not aligned while VirtualSize was, which made larger_image_size smaller than VirtualAddress + SizeOfRawData in the _test_read check for the last section.
I then replaced the line larger_image_size = this->_image_size + new_section_size; with larger_image_size =_section_align((DWORD)_image_size, _header_pe64->OptionalHeader.SectionAlignment) + new_section_size; and everything worked.
I'm not sure if it's the correct way to fix it though.
from process-dump.
glmcdona
commented on September 21, 2024
Hi Yuping,
Could you try running process dump from command prompt like "pd.exe -pid
0x<process> -v &> log.txt". The '-v' enables verbose mode, and it should
log what it is thinking to log.txt. Could you send this with me, along with
the address you are talking about? Which version of Process Dump are you
using?
Thanks,
Geoff
…On Sun, Jan 22, 2017 at 2:57 PM, Yuping Liang ***@***.***> wrote:
Don't know if I should post a question here but I get zeros in some
regions of the dump file when there is clearly executable code in those
regions according to CE. I know little about segments and how they are
arranged and loaded into memory and I've been struggling figuring out what
the problem was.
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
<#11>, or mute the thread
<https://github.com/notifications/unsubscribe-auth/AC6mXrqIepsFEo59o69QTnv_WxO1OM2Tks5rU7S2gaJpZM4Lqe9y>
.
from process-dump.
glmcdona
commented on September 21, 2024
Thanks, great analysis! I think your adjustment is right, I will have a look in detail at the code and think on it before committing it. I'm surprised it left the entire section empty as a result of this as well, I need to review the code surrounding that truncation error.
from process-dump.
glmcdona
commented on September 21, 2024
Fixed. This will be released in pd v2.1 which I should have built and uploaded shortly. Thanks for finding the root cause and proposing a solution!
from process-dump.
Related Issues (20)
- Clean database add by folder can't have trailing slash
- Latest build of Process Dump close monitor is crashing csrss.exe HOT 1
- 64bit ImageBase being truncated to 32bit HOT 3
- can not dump some 32 bit .net exe file which run as 64 bit jit code,like Reflector.exe HOT 2
- Large section size HOT 2
- Walkthrough for restoring OEP and IAT for dumped executables? HOT 11
- .Net dump HOT 1
- Req: -closemon2: detection for new modules loaded after loading pd64.exe -closemon HOT 5
- Why do codechunks need at least 5 imports for dumping HOT 1
- Clean database generation failing at %USERPROFILE% adding HOT 1
- Compiler error: syntax error: identifier 'pe_hash_database' HOT 1
- Spotify.exe (and some other apps) dumping creating huge dump of main exe HOT 2
- Suggestion HOT 6
- Close monitor mode dumps codechunks from ProcessDump injections
- Increase frequency of multi-threaded queue status prints HOT 1
- Windows XP 32bit process dump not dumping modules HOT 2
- Repeated allocation failure error for close monitor hook HOT 1
- Hook CreateProcess so that short-lived processes are dumped on close
- Stop ProcessDump from hooking it's own processes NtProcessTermination HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from process-dump.