Invalid-NumberOfRvaAndSizes

Description

The NumberOfRvaAndSizes represents the number of data-directory entries in the remainder of the optional header. Each describes a location and size. For more information, refer to this page.

Malware authors could set the value of the NumberOfRvaAndSizes field to an inconsistent value so that OllyDbg will display the following message:

You can fix the value of NumberOfRvaAndSizes with xPELister ("NT Header Data" tab) or with CFF Explorer and updating the value to "0x00000010":

Note

The Windows loader ignores any NumberOfRvaAndSizes greater than 0x10, because anything larger will not fit in the DataDirectory array.

Then save the modifications (File > Save)

Comments

Keywords: anti-reverse pe NumberOfRvaAndSizes bad or unknown format of 32-bit executable file