PE files parsed incorrectly with sections that overlap

Open

#8,412 opened on Aug 13, 2026 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 50/100

Issue type: Bug
Clarity: Mostly clear
Activity status: Quiet
Tech stack: cpp
Domain: reverse-engineering

Research direction

Start at the mentioned PEView::RVAToFileOffset entry point and reproduce the failure with the Dogbolt binary hash 215bec7e5a30eac4ff15051dac1bc2c634a48ebb4caeac6d0047e9195967889d. Use bv.relocation_ranges_at(here) and the rebasing steps to inspect relocation parsing; done means the relocation directory parses without an out-of-bounds error and the vftable pointer rebases correctly.

Written by the indexing model from the issue text.

Description

File Format: PE

Version and Platform (required):

Binary Ninja Version: 5.4.10303-dev
Edition: Ultimate
OS: macOS
OS Version: 26.6
CPU Architecture: arm64

Bug Description:
In certain PE files, parsing some of the relocation data fails due to the resource section overlapping in our binary parsing.

Steps To Reproduce:

Open the binary from dogbolt with hash 215bec7e5a30eac4ff15051dac1bc2c634a48ebb4caeac6d0047e9195967889d
Observe error: [BinaryView.PEView] Failed to parse relocation directory: read out of bounds
Navigate to 10016160
Python: bv.relocation_ranges_at(here)
Rebase binary to 20000000
Observe vftable pointer is not rebased properly

Expected Behavior:
I expected all of the relocations to be parsed.

Screenshots/Video Recording:

Binary:
Dogbolt binary, PE/windows-x86, with hash 215bec7e5a30eac4ff15051dac1bc2c634a48ebb4caeac6d0047e9195967889d

Additional Information:
Codex says that PEView::RVAToFileOffset is incorrect and causing the binary reader to read from the rsrc section's offset when trying to read bytes from the reloc section. Codex suggested a significantly more complicated fix than I was expecting. Attempting to map an address to an RVA and vice versa is apparently much more complicated than I thought.

Dominant language: C++
Stars: 1.3k
Forks: 298
Avg merge: 4d 13h
Merged PRs (30d): 20

Contributor guide

No contributing guide indexed for this repository

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

Use 4:4:4 for multichannel AVIF and HEIF gain maps Open

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

google/libultrahdr#485 · Opened Sep 24, 2026
Missing tile warnings in TileMap dock display with wrong texture filter Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

godotengine/godot#123776 · Opened Sep 23, 2026
if(cond,a,b) treats any nonzero cond as true in every bngsim backend (ExprTk interpreter, C codegen, SSA), which contradicts docs/reference/expressions.md ('true when > 0.5') and BNG's run_network. A non-boolean condition in (-inf,0) or... Open

bug

Difficulty 1/5 Under an hour Newbie friendliness 60/100

lanl/bngsim#774 · Opened Sep 23, 2026
Delete ament_export_include_directories() and ament_export_libraries() calls Open

good first issue

Difficulty 1/5 Under an hour Newbie friendliness 90/100

ros2/rosbag2#2509 · Opened Sep 23, 2026
Delete ament_export_include_directories() and ament_export_libraries() calls Open

good first issue

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

ros2/common_interfaces#344 · Opened Sep 23, 2026

More C++ issues