petools icon indicating copy to clipboard operation
petools copied to clipboard
verified publisher icon petoolse

App crashing on specific exe

Open greenozon opened this issue 1 year ago • 1 comments

Found out very tricky PE64 binary

it has lots of surprizes! eg: on d-n-d event: image

Directories??!

image

it CRASHES on clicking Entropy button image

image

file (no virus no malware, just a very nice digital clock) Clock7.zip

greenozon avatar Oct 27 '24 07:10 greenozon

@greenozon Alex, there are some issues with your file Clock7.exe file that make it different from the ordinal executable:

  1. PE header is located inside DOS header (at 0x10), so it's not allowed to edit DOS header (it's already optimised to contain PE header, so editing it will corrupt both headers).

  2. File doesn't contain any Directory, NumberOfRvaAndSizes = 0.

  3. File is encrypted with simple algo (rol/ror/xor).

  4. Code is compressed using aPLib compression library.

Anyway there is a bug in Entropy calculation code.

upiter avatar Dec 04 '24 11:12 upiter