Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Import editor 'Add a library' not working #41

Open
learn-more opened this issue Dec 5, 2021 · 2 comments
Open

Import editor 'Add a library' not working #41

learn-more opened this issue Dec 5, 2021 · 2 comments

Comments

@learn-more
Copy link

learn-more commented Dec 5, 2021

Hello,

When trying to add a library in the import editor (after moving the data directory table to a new section) the new entry is red,
a name cannot be entered (doubleclicking the name allows to type it in, but then saving it makes it empty again).
The 'OriginalFirstThunk', 'NameRVA' and 'FirstThunk' are all set to 0xffffffff, and cannot be edited.
Clicking 'Add a function to the library' shows a message 'No space to add a function entry!'

Attached is the test file (strace from a cygwin distribution).
strace.zip

Exact reproduction steps:

  • Open PE-bear (PE-bear_0.5.5_x64_win_vs17.zip)
  • Drag strace.exe onto PE-bear
  • Right click 'Sections' in the left tree, click on 'Add a new section'
  • 'Section name': 'test', 'Raw size': 1000, 'Virtual size': 1000, check 'read' and 'write' -> OK (Section is created at RAW:9E00, VA:21000)
  • Go to 'Imports' tab
  • Click on 'Move the data directory table', use target RVA:21000 -> 'OK'
  • Click on 'Add a library':
    A red row shows up with all pointers set to 0xffffffff
@hasherezade
Copy link
Owner

Hi! sorry for the late response, I was busy.
It seems to me that you are missing some steps. See this short guide: https://github.com/hasherezade/pe-bear-releases/wiki/Import-adding - I see you are at the step 5.

@learn-more
Copy link
Author

learn-more commented Feb 16, 2022

At step 5, I cannot edit those?
When I click on them, I get a popup telling me 'Address out of bounds!'

hmmm, this seems to be caused by 'follow rva on click'

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants