Trying to GetContent() of a ImportAddressTable causes overflow exception

[philipbraatz]

System.OverflowException: 'Value was either too large or too small for a UInt32.'
at System.Convert.ToUInt32(UInt64 value)
at Workshell.PE.LocationCalculator.VAToOffset(UInt64 va)
at Workshell.PE.DataDirectory.d__10.MoveNext()
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Workshell.PE.DataDirectory.GetContent()
at Doorfail.Reverse.BL.Utility.d__1.MoveNext() in C:\Users\philb\source\repos\Doorfail.Reverse.UI.Console\BL\Utility.cs:line 55

foreach (var item in pe.NTHeaders.DataDirectories) { if (!item.IsEmpty) { Console.WriteLine(pe.NTHeaders + "Data Directory, Directory Type: " + item.DirectoryType + ", size " + item.Size); Console.WriteLine("Content DataDirectory, Directory Type: "+item.GetContent());//line 55 Console.WriteLine("Section Name: " + item.GetSection().Name); Console.WriteLine("Sections: " + item.GetSection().Sections); Console.WriteLine("Sections: " + item.GetSection().TableEntry); } }

[lkinsella]

Curious.

If you switch to the pei-changes branch do you still have the same issue?

[philipbraatz]

I have it installed through NuGet Package Manager in Visual Studio. version 2.1.0.47 . From there I don't see a way of doing that.

[lkinsella]

Ahh no worries thought you might be working from source.

I’ll look into it, could be we’ve already fixed it there’s a bunch of changes in that branch.

Do you know what the value is at all? Would be useful for testing.

[philipbraatz]

I am unable to check the value for you, sorry. This is the file I am testing with though.
TestScript2.zip

[lkinsella]

This should be fixed now, turns out it was using the VA when it should have been using RVA.

It should be available on NuGet as version 2.1.1.53.