diff --git a/phlib/mapimg.c b/phlib/mapimg.c index 44957e1..bc1d6bc 100644 --- a/phlib/mapimg.c +++ b/phlib/mapimg.c @@ -1229,8 +1229,12 @@ NTSTATUS PhGetMappedImageCfg( if (!NT_SUCCESS(status = PhGetMappedImageLoadConfig64(MappedImage, &config64))) return status; + // Not every load configurations define the CFG characteristics + if (config64->Size < (DWORD) FIELD_OFFSET(IMAGE_LOAD_CONFIG_DIRECTORY64, GuardAddressTakenIatEntryTable)) + return STATUS_INVALID_VIEW_SIZE; + @@ -1255,7 +1259,7 @@ NTSTATUS PhGetMappedImageCfg( PhpMappedImageProbe( MappedImage, CfgConfig->GuardFunctionTable, - CfgConfig->EntrySize * CfgConfig->NumberOfGuardFunctionEntries + (SIZE_T)(CfgConfig->EntrySize * CfgConfig->NumberOfGuardFunctionEntries) ); } __except (EXCEPTION_EXECUTE_HANDLER) @@ -1278,7 +1282,7 @@ NTSTATUS PhGetMappedImageCfg( PhpMappedImageProbe( MappedImage, CfgConfig->GuardAdressIatTable, - CfgConfig->EntrySize * CfgConfig->NumberOfGuardAdressIatEntries + (SIZE_T)(CfgConfig->EntrySize * CfgConfig->NumberOfGuardAdressIatEntries) ); } __except (EXCEPTION_EXECUTE_HANDLER) @@ -1301,7 +1305,7 @@ NTSTATUS PhGetMappedImageCfg( PhpMappedImageProbe( MappedImage, CfgConfig->GuardLongJumpTable, - CfgConfig->EntrySize * CfgConfig->NumberOfGuardLongJumpEntries + (SIZE_T)(CfgConfig->EntrySize * CfgConfig->NumberOfGuardLongJumpEntries) ); } __except (EXCEPTION_EXECUTE_HANDLER) diff --git a/tools/peview/peprp.c b/tools/peview/peprp.c index eb3636d..52fe8c9 100644 --- a/tools/peview/peprp.c +++ b/tools/peview/peprp.c @@ -856,7 +856,7 @@ INT_PTR CALLBACK PvpPeLoadConfigDlgProc( PhSetListViewSubItem(lvHandle, lvItemIndex, 1, Value); \ } - #define ADD_VALUES(Config) \ + #define ADD_VALUES(ConfigStruct, Config) \ { \ LARGE_INTEGER time; \ SYSTEMTIME systemTime; \ @@ -882,29 +882,32 @@ INT_PTR CALLBACK PvpPeLoadConfigDlgProc( ADD_VALUE(L"SEH handler table", PhaFormatString(L"0x%Ix", (Config)->SEHandlerTable)->Buffer); \ ADD_VALUE(L"SEH handler count", PhaFormatUInt64((Config)->SEHandlerCount, TRUE)->Buffer); \ ADD_VALUE(L"SEH handler count", PhaFormatUInt64((Config)->SEHandlerCount, TRUE)->Buffer); \ - ADD_VALUE(L"CFG GuardFlags", PhaFormatString(L"0x%Ix", (Config)->GuardFlags)->Buffer); \ - ADD_VALUE(L"CFG Check Function pointer", PhaFormatString(L"0x%Ix", (Config)->GuardCFCheckFunctionPointer)->Buffer); \ - ADD_VALUE(L"CFG Check Dispatch pointer", PhaFormatString(L"0x%Ix", (Config)->GuardCFDispatchFunctionPointer)->Buffer); \ - ADD_VALUE(L"CFG Function table", PhaFormatString(L"0x%Ix", (Config)->GuardCFFunctionTable)->Buffer); \ - ADD_VALUE(L"CFG Function table entry count", PhaFormatString(L"0x%Ix", (Config)->GuardCFFunctionCount)->Buffer); \ - ADD_VALUE(L"CFG IatEntry table", PhaFormatString(L"0x%Ix", (Config)->GuardAddressTakenIatEntryTable)->Buffer); \ - ADD_VALUE(L"CFG IatEntry table entry count", PhaFormatString(L"0x%Ix", (Config)->GuardAddressTakenIatEntryCount)->Buffer); \ - ADD_VALUE(L"CFG LongJump table", PhaFormatString(L"0x%Ix", (Config)->GuardLongJumpTargetTable)->Buffer); \ - ADD_VALUE(L"CFG LongJump table entry count", PhaFormatString(L"0x%Ix", (Config)->GuardLongJumpTargetCount)->Buffer); \ + if ((Config->Size) >= (DWORD) FIELD_OFFSET(ConfigStruct, GuardAddressTakenIatEntryTable)) \ + { \ + ADD_VALUE(L"CFG GuardFlags", PhaFormatString(L"0x%Ix", (Config)->GuardFlags)->Buffer); \ + ADD_VALUE(L"CFG Check Function pointer", PhaFormatString(L"0x%Ix", (Config)->GuardCFCheckFunctionPointer)->Buffer); \ + ADD_VALUE(L"CFG Check Dispatch pointer", PhaFormatString(L"0x%Ix", (Config)->GuardCFDispatchFunctionPointer)->Buffer); \ + ADD_VALUE(L"CFG Function table", PhaFormatString(L"0x%Ix", (Config)->GuardCFFunctionTable)->Buffer); \ + ADD_VALUE(L"CFG Function table entry count", PhaFormatString(L"0x%Ix", (Config)->GuardCFFunctionCount)->Buffer); \ + ADD_VALUE(L"CFG IatEntry table", PhaFormatString(L"0x%Ix", (Config)->GuardAddressTakenIatEntryTable)->Buffer); \ + ADD_VALUE(L"CFG IatEntry table entry count", PhaFormatString(L"0x%Ix", (Config)->GuardAddressTakenIatEntryCount)->Buffer); \ + ADD_VALUE(L"CFG LongJump table", PhaFormatString(L"0x%Ix", (Config)->GuardLongJumpTargetTable)->Buffer); \ + ADD_VALUE(L"CFG LongJump table entry count", PhaFormatString(L"0x%Ix", (Config)->GuardLongJumpTargetCount)->Buffer); \ + } \ } if (PvMappedImage.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC) { if (NT_SUCCESS(PhGetMappedImageLoadConfig32(&PvMappedImage, &config32))) { - ADD_VALUES(config32); + ADD_VALUES(IMAGE_LOAD_CONFIG_DIRECTORY32, config32); } } else { if (NT_SUCCESS(PhGetMappedImageLoadConfig64(&PvMappedImage, &config64))) { - ADD_VALUES(config64); + ADD_VALUES(IMAGE_LOAD_CONFIG_DIRECTORY64, config64); } }