Invalid-NumberOfRvaAndSizes

From aldeid
Jump to navigation Jump to search

Description

The NumberOfRvaAndSizes represents the number of data-directory entries in the remainder of the optional header. Each describes a location and size. For more information, refer to this page.

Malware authors could set the value of the NumberOfRvaAndSizes field to an inconsistent value so that OllyDbg will display the following message:

OllyDbg-inconsistent-NumberOfRvaAndSizes.png

You can fix the value of NumberOfRvaAndSizes with xPELister ("NT Header Data" tab) or with CFF Explorer and updating the value to "0x00000010":

Info.png
Note
The Windows loader ignores any NumberOfRvaAndSizes greater than 0x10, because anything larger will not fit in the DataDirectory array.

Fixing-NumberOfRvaAndSizes.png

Then save the modifications (File > Save)

Comments

blog comments powered by Disqus

Keywords: anti-reverse pe NumberOfRvaAndSizes bad or unknown format of 32-bit executable file