BadImageFormatException for import symbols

[Avroke]

AsmResolver Version

5.2.0

.NET Version

.NET 4.8

Operating System

Windows

Describe the Bug

All PE files packed or unpacked by the UPX tool make it impossible for AsmResolver to read the import symbols, because the BadImageFormatException is thrown.

As with the official Mozilla Firefox installer, downloadable at this link: Firefox Installer.exe

How To Reproduce

A simple code which should normally list the imports:

IPEImage peImage = PEImage.FromFile("Firefox Installer.exe");
foreach (var import in peImage.Imports)
{
     foreach (var symbol in import.Symbols) //The exception is here.
     {
          Console.WriteLine(import.Name + "!" + symbol.Name);
     }
}

Expected Behavior

It should be possible to parse the import symbols for this type of PE. Secana's PeNet library does it, with this simple code:

PeNet.PeFile peFile = new PeNet.PeFile("Firefox Installer.exe");
foreach (var import in peFile.ImportedFunctions)
{
    Console.WriteLine(import.DLL + "!" + import.Name);
}

The expected result:

KERNEL32.DLL!LoadLibraryA
KERNEL32.DLL!ExitProcess
KERNEL32.DLL!GetProcAddress
KERNEL32.DLL!VirtualProtect

Actual Behavior

The System.BadImageFormatException : 'Imported module "KERNEL32.DLL" has an invalid import lookup thunk table RVA.' is thrown as soon as the Symbols method of an ImportedModule is called.

Additional Context

No response

[Washi1337]

Thanks for reporting. A potential fix has been pushed to PR #432. Could you please verify that this indeed solves your issue? You can download the build artifacts from AppVeyor once they're done.

[Avroke]

Hello, all works perfectly!! Thank you so much for fixing this problem so quickly, it helps me a lot.

[Washi1337]

Perfect! This will then be part of 5.3.0, which I intend to push to nuget in the upcoming days.