{"record":{"id":"d45b803f3518c605","repo":"t8y2/dbx","slug":"pe-rva-0x-rva-x-is-not-backed-by-file-data","errorCode":null,"errorMessage":"PE RVA 0x{rva:x} is not backed by file data","messagePattern":"PE RVA 0x(.+?) is not backed by file data","errorType":"exception","errorClass":"PeFormatError","httpStatus":null,"severity":"error","filePath":"agents/scripts/validate_windows_pe_dependencies.py","lineNumber":85,"sourceCode":"            (\n                _read_u32(data, section_offset + 12),\n                _read_u32(data, section_offset + 8),\n                _read_u32(data, section_offset + 20),\n                _read_u32(data, section_offset + 16),\n            )\n        )\n\n    def rva_to_offset(rva: int) -> int:\n        if rva < size_of_headers:\n            return rva\n        for virtual_address, virtual_size, raw_offset, raw_size in sections:\n            span = max(virtual_size, raw_size)\n            if virtual_address <= rva < virtual_address + span:\n                delta = rva - virtual_address\n                if delta >= raw_size:\n                    break\n                return raw_offset + delta\n        raise PeFormatError(f\"PE RVA 0x{rva:x} is not backed by file data\")\n\n    descriptor_offset = rva_to_offset(import_directory_rva)\n    imports = []\n    for _ in range(4096):\n        if descriptor_offset + 20 > len(data):\n            raise PeFormatError(\"truncated PE import descriptor\")\n        descriptor = data[descriptor_offset : descriptor_offset + 20]\n        if descriptor == b\"\\0\" * 20:\n            return sorted(set(imports), key=str.casefold)\n        name_rva = _read_u32(data, descriptor_offset + 12)\n        if name_rva == 0:\n            raise PeFormatError(\"PE import descriptor has no DLL name\")\n        imports.append(_read_c_string(data, rva_to_offset(name_rva)))\n        descriptor_offset += 20\n\n    raise PeFormatError(\"PE import descriptor table is not terminated\")\n\n","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/scripts/validate_windows_pe_dependencies.py#L67-L103","documentation":"The parser converts a relative virtual address (RVA) from the PE headers to a file offset using the section table. This error means the requested RVA (here the import directory RVA, or a DLL-name RVA via the nested rva_to_offset) does not fall inside any section's mapped range, or falls past a section's raw data on disk. The library throws it because the bytes the RVA points to are simply not present in the file, so the import table cannot be read safely.","triggerScenarios":"imported_dlls(path) on a PE whose import directory RVA (data directory index 1) points outside all sections; a DLL-name RVA inside a section's virtual span but beyond its raw size; headers whose SizeOfHeaders/section VirtualAddress or PointerToRawData fields were corrupted or zeroed.","commonSituations":"Analyzing packed/obfuscated binaries that fake their section table; malformed PE samples from malware corpora or fuzzers; binaries damaged by incomplete download or bad packaging; using the tool on non-image PE variants (object files) where RVAs are meaningless.","solutions":["Inspect the PE's section table (e.g. with pefile or dumpbin /headers) and confirm the import directory RVA lies within a mapped section with raw data present.","Rebuild or re-download the binary; an RVA not backed by file data usually indicates corruption or a deliberately malformed file.","If the binary is packed and its import directory legitimately points into unpacked-in-memory regions, analyze the unpacked image instead.","Catch PeFormatError around imported_dlls and treat the file as 'unverifiable' rather than letting the validator crash."],"exampleFix":"// before\nimports = imported_dlls(Path(binary_path))\n// after\ntry:\n    imports = imported_dlls(Path(binary_path))\nexcept PeFormatError as err:\n    raise RuntimeError(f\"{binary_path}: cannot resolve PE RVAs: {err}\") from err","handlingStrategy":"try-catch","validationCode":"import pefile\n\ndef rvas_are_backed(path) -> bool:\n    pe = pefile.PE(path)\n    rva = pe.OPTIONAL_HEADER.DATA_DIRECTORY[1].VirtualAddress\n    if rva == 0:\n        return True\n    return pe.get_offset_from_rva(rva) is not None","typeGuard":"def rva_in_section(rva: int, sections: list[tuple[int, int, int, int]], size_of_headers: int) -> bool:\n    return rva < size_of_headers or any(\n        va <= rva < va + max(vs, rs) for va, vs, _, rs in sections\n    )","tryCatchPattern":"try:\n    imports = imported_dlls(path)\nexcept PeFormatError as err:\n    if \"not backed by file data\" in str(err):\n        handle_unverifiable(path, err)\n    else:\n        raise","preventionTips":["Confirm binaries are complete (size/hash check) before validation.","Avoid analyzing packed binaries whose import tables point to unpacked-in-memory RVAs; unpack first.","Cross-check section tables with dumpbin /headers when in doubt.","Fail soft per-artifact in batch validators so one bad file does not halt the run."],"tags":["pe-format","rva","binary-parsing","corrupt-file","python"],"backgroundTag":"pe-rva-not-backed-by-file-data","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}