hasherezade / bearparser

Portable Executable parsing library (from PE-bear)

Home Page:https://hasherezade.github.io/bearparser

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Error in get LastMapped: empty sections are not excluded

hasherezade opened this issue · comments

Test case:

wrong_last_mapped

Bearparser mistakenly detects the beginning of the new section as the Last RVA. However, this section has a mapped size 0 - means, it won't be mapped at all.
So, in reality the Last mapped RVA is the end of the section that was before: 1EE00.

Fixed:

map_fixed