se2dev / libpebliss Goto Github PK

In most PE files, the values of the OFTs and FTs for a given symbol import should be identical.

It seems that regardless of the import builder settings, IAT FTs always use the values explicitly defined by
import_function::set_iat_va(ft_value);. This works fine for re-building existing imports (as the value that was already in the PE will be reused), but for adding new imports (see the import_adder example) - the FTs will not have the correct value - as a result, the generated PE may function correctly in some cases, and fail in others.

Generally, the OFTs are automatically calculated, but but using the following settings will result in the FTs being automatically calculated, but both the module and imports for that module will have null OFTs.

import_rebuilder_settings settings(true, false);
settings.build_original_iat(false);
settings.fill_missing_original_iats(false);

I'm not sure if this behavior is a bug, oversight, or another issue entirely.

When running the import_adder example, the new imports section is truncated and doesn't contain the correct padding length. This appears to be due to a mismatch between section::get_raw_data()::length()and the value yielded bysection::get_size_of_raw_data()`