Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

PE import error: Specified length extends beyond file bytes length

See original GitHub issue

c876a332d7dd8da331cb8eee7ab7bf32752834d4b2b54eaa362674a2a48f64a6.zip

Describe the bug Ghidra is unable to import the file with SHA256 hashsum c876a332d7dd8da331cb8eee7ab7bf32752834d4b2b54eaa362674a2a48f64a6, triggering a java.lang.IndexOutOfBoundsException.

To Reproduce Steps to reproduce the behavior:

Drag the sample with SHA256 into a project

Expected behavior Ghidra is expected to import the file and proceed to disassemble.

Screenshots

Error importing file: Lab01-02.exe
java.lang.IndexOutOfBoundsException: Specified length extends beyond file bytes length
    at ghidra.program.database.mem.MemoryMapDB.checkFileBytesRange(MemoryMapDB.java:583)
    at ghidra.program.database.mem.MemoryMapDB.createInitializedBlock(MemoryMapDB.java:546)
    at ghidra.app.util.MemoryBlockUtils.createInitializedBlock(MemoryBlockUtils.java:225)
    at ghidra.app.util.opinion.PeLoader.processMemoryBlocks(PeLoader.java:622)
    at ghidra.app.util.opinion.PeLoader.load(PeLoader.java:121)
    at ghidra.app.util.opinion.AbstractLibrarySupportLoader.doLoad(AbstractLibrarySupportLoader.java:346)
    at ghidra.app.util.opinion.AbstractLibrarySupportLoader.loadProgram(AbstractLibrarySupportLoader.java:83)
    at ghidra.app.util.opinion.AbstractProgramLoader.load(AbstractProgramLoader.java:112)
    at ghidra.plugin.importer.ImporterUtilities.importSingleFile(ImporterUtilities.java:401)
    at ghidra.plugin.importer.ImporterDialog.lambda$okCallback$7(ImporterDialog.java:351)
    at ghidra.util.task.TaskLauncher$1.run(TaskLauncher.java:90)
    at ghidra.util.task.Task.monitoredRun(Task.java:126)
    at ghidra.util.task.TaskRunner.lambda$startTaskThread$1(TaskRunner.java:94)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
    at java.base/java.lang.Thread.run(Thread.java:834)

---------------------------------------------------
Build Date: 2019-Oct-23 1737 EDT
Ghidra Version: 9.1
Java Home: C:\java\jdk-11.0.2
JVM Version: Oracle Corporation 11.0.2
OS: Windows 7 6.1 amd64

Attachments File with SHA256 hashsum c876a332d7dd8da331cb8eee7ab7bf32752834d4b2b54eaa362674a2a48f64a6 is attached (password: infected).

Environment (please complete the following information):

OS: Windows 7 (6.1) amd64
Java Version: 11.0.2
Ghidra Version: 9.1

Issue Analytics

State:
Created 4 years ago
Comments:5 (1 by maintainers)

Top GitHub Comments

1reaction

astrelskycommented, Nov 20, 2019

Just a question regarding the password . Is the binary in question actually infected with something?

0reactions

ChrisDietrichcommented, Nov 21, 2019

@ryanmkurtz, perfect. Thank you very much!

Top Results From Across the Web

PE import error, Vol 2: Specified length extends beyond file ...

Here's a snip of the metadata courtesy of CFFExplorer, which includes the file size (134085 bytes), the PE size (134144 bytes) and some...

exe import error: Specified length extends beyond file bytes ...

I'm attempting to import an old Win95 game into Ghidra for disassembly, but Ghidra throws an error when importing the portable executable file...

PE Format - Win32 apps - Microsoft Learn

This specification describes the structure of executable (image) files and object files under the Windows family of operating systems.

pefile.py - external/pefile - Git at Google

This will set a maximum length of a string to be retrieved from the file. # It's there to prevent loading massive amounts...

PE — LIEF Documentation

The size in bytes of the template, beyond the initialized data delimited by the addressof_raw_data fields. The total template size should be the ......