Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

ArgumentOutOfRangeException thrown during computation of TypeRefHash

See original GitHub issue

We frequently see this exception in our processing. I don’t know yet whether this is caused by a bug in PeNet or whether the .NET header is malformed.

Full stack trace:

System.ArgumentOutOfRangeException: Index was out of range. Must be non-negative and less than the size of the collection. (Parameter 'index')
   at PeNet.Header.Net.MetaDataTablesHdr.ParseTableDefinitions()
   at PeNet.Header.Net.MetaDataTablesHdr.get_TableDefinitions()
   at PeNet.Header.Net.MetaDataTablesHdr.ParseTable[T](MetadataToken token)
   at PeNet.Header.Net.MetaDataTablesHdr.ParseMetaDataTables()
   at PeNet.Header.Net.TypeRefHash.ComputeHash()
   at PeNet.PeFile.get_TypeRefHash()

This malware sample for example leads to the exception: https://www.virustotal.com/gui/file/f88e743fdd410a89b7084076883164120e3abe7f8f08ad65bb0fec05b392d3b1/

Issue Analytics

State:
Created 2 years ago
Comments:6 (5 by maintainers)

Top GitHub Comments

1reaction

Washi1337commented, Jan 16, 2022

Sure I can have a look at it when I get the time somewhere next week. I am not too familiar yet with the internals of this library yet, so will have to read up on that first.

1reaction

secanacommented, Dec 8, 2021

I’ve looked into the sample and it seems to be crypted somehow. The data in the metadata tables is broken and cannot be recovered. None the less, PeNet should’t just crash on that, but instead fail to parse the broken parts. I’ll see what I can do about that.