Undocumented PE Header Machine Type

[gfs]

@dotnet/jit-contrib

I discovered some PE binaries that are System packages that have undocumented machine codes. The binaries with those machine codes are linked below along with related GitHub issues in a PE header parsing library.

• 0xC020 - https://github.com/secana/PeNet/files/4589793/Microsoft.VisualBasic.Core.dll.zip ( see also Fatal Internal CLR Error secana/PeNet#143)
• 0xFD1D - https://github.com/secana/PeNet/files/4587936/Microsoft.VisualBasic.Core.dll.zip ( see also Fatal Internal CLR Error Getting Authenticode from Attached secana/PeNet#142)

The documentation does not list these as possible machine type codes: https://docs.microsoft.com/en-us/windows/win32/debug/pe-format

See linked bugs also for potential issues with memmove causing fatal CLR crash.

[AndyAyersMS]

PE headers are written by language compilers or by crossgen-like tools. So changing area to VM.

[janvorli]

The machine codes that are documented on MSDN are for Windows. For other OS-es, we xor them with an OS specific value so that we can prevent binaries for e.g. Linux amd64 to be used on Windows amd64 or OSX amd64.
See:

runtime/src/coreclr/src/inc/pedecoder.h

Lines 90 to 104 in 61c6581

	#if defined(__APPLE__)
	#define IMAGE_FILE_MACHINE_NATIVE_OS_OVERRIDE 0x4644
	#elif defined(__FreeBSD__)
	#define IMAGE_FILE_MACHINE_NATIVE_OS_OVERRIDE 0xADC4
	#elif defined(__linux__)
	#define IMAGE_FILE_MACHINE_NATIVE_OS_OVERRIDE 0x7B79
	#elif defined(__NetBSD__)
	#define IMAGE_FILE_MACHINE_NATIVE_OS_OVERRIDE 0x1993
	#elif defined(__sun)
	#define IMAGE_FILE_MACHINE_NATIVE_OS_OVERRIDE 0x1992
	#else
	#define IMAGE_FILE_MACHINE_NATIVE_OS_OVERRIDE 0
	#endif
	#define IMAGE_FILE_MACHINE_NATIVE_NI (IMAGE_FILE_MACHINE_NATIVE ^ IMAGE_FILE_MACHINE_NATIVE_OS_OVERRIDE)

[janvorli]

So 0xC020 == 0x8664 xor 0x4644 => OSX amd64
and 0xFD1D == 0x8664 xor 0x7B79 => Linux amd64

[GrabYourPitchforks]

The issues Gabe linked to also potentially finger memmove as a reliability issue. I remember we had a bug a while back with this on Full Framework, but I don't recall offhand if it affected Core 3.1.3.

[gfs]

On the memmove topic, from the linked bugs:

Fatal error. Internal CLR error. (0x80131506)
   at System.Buffer._Memmove(Byte ByRef, Byte ByRef, UInt64)
   at System.Buffer.Memmove(Byte ByRef, Byte ByRef, UInt64)
   at System.Span`1[[System.Byte, System.Private.CoreLib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]].ToArray()
   at PeNet.Header.Authenticode.ContentInfo..ctor(System.Span`1<Byte>)
   at PeNet.Header.Authenticode.AuthenticodeInfo..ctor(PeNet.PeFile)
   at PeNet.HeaderParser.Authenticode.AuthenticodeParser.ParseTarget()
   at PeNet.PeFile.get_Authenticode()
   at AttackSurfaceAnalyzer.Collectors.WindowsFileSystemUtils.GetSignatureStatus(System.String)

[mangod9]

@gfs, can this be closed for now? Assume the memmove is a different issue than the title?

[gfs]

The memmove issue is not related to the title but was a symptom. I think per @GrabYourPitchforks it was worth tracking but if you want to separate the issues for tracking and close this that's fine.

[mangod9]

yeah a separate issue would help with triaging appropriately. Thx