diff --git a/qiling/loader/pe.py b/qiling/loader/pe.py index 724a33a9a..8fd7dd4ed 100644 --- a/qiling/loader/pe.py +++ b/qiling/loader/pe.py @@ -553,6 +553,10 @@ def init_exports(self, pe: pefile.PE): # Do a full load if IMAGE_DIRECTORY_ENTRY_EXPORT is present so we can load the exports pe.full_load() + + # address corner case for malformed export tables where IMAGE_DIRECTORY_ENTRY_EXPORT exists, but DIRECTORY_ENTRY_EXPORT does not + if not hasattr(pe, 'DIRECTORY_ENTRY_EXPORT'): + return iat = {} diff --git a/qiling/os/windows/dlls/kernel32/libloaderapi.py b/qiling/os/windows/dlls/kernel32/libloaderapi.py index 29b4ce88f..d7a2b4b3d 100644 --- a/qiling/os/windows/dlls/kernel32/libloaderapi.py +++ b/qiling/os/windows/dlls/kernel32/libloaderapi.py @@ -144,10 +144,6 @@ def hook_GetProcAddress(ql: Qiling, address: int, params): # let log output reflect a human-readable procname params["lpProcName"] = procname - # WORKAROUND for gandcrab - if procname == "RtlComputeCrc32": - return 0 - procname = procname.encode('latin1') else: