{"record":{"id":"e2107c40229da9aa","repo":"t8y2/dbx","slug":"pe-import-descriptor-has-no-dll-name","errorCode":null,"errorMessage":"PE import descriptor has no DLL name","messagePattern":"PE import descriptor has no DLL name","errorType":"exception","errorClass":"PeFormatError","httpStatus":null,"severity":"error","filePath":"agents/scripts/validate_windows_pe_dependencies.py","lineNumber":97,"sourceCode":"            span = max(virtual_size, raw_size)\n            if virtual_address <= rva < virtual_address + span:\n                delta = rva - virtual_address\n                if delta >= raw_size:\n                    break\n                return raw_offset + delta\n        raise PeFormatError(f\"PE RVA 0x{rva:x} is not backed by file data\")\n\n    descriptor_offset = rva_to_offset(import_directory_rva)\n    imports = []\n    for _ in range(4096):\n        if descriptor_offset + 20 > len(data):\n            raise PeFormatError(\"truncated PE import descriptor\")\n        descriptor = data[descriptor_offset : descriptor_offset + 20]\n        if descriptor == b\"\\0\" * 20:\n            return sorted(set(imports), key=str.casefold)\n        name_rva = _read_u32(data, descriptor_offset + 12)\n        if name_rva == 0:\n            raise PeFormatError(\"PE import descriptor has no DLL name\")\n        imports.append(_read_c_string(data, rva_to_offset(name_rva)))\n        descriptor_offset += 20\n\n    raise PeFormatError(\"PE import descriptor table is not terminated\")\n\n\ndef forbidden_msvc_runtime_dlls(imports: list[str]) -> list[str]:\n    return sorted(\n        {name for name in imports if name.casefold().startswith((\"msvcp\", \"vcruntime\"))},\n        key=str.casefold,\n    )\n\n\ndef main() -> int:\n    parser = argparse.ArgumentParser(description=\"Reject Windows PE files that require the Visual C++ runtime\")\n    parser.add_argument(\"binary\", type=Path)\n    args = parser.parse_args()\n","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/scripts/validate_windows_pe_dependencies.py#L79-L115","documentation":"Each non-terminal import descriptor must carry a valid Name RVA (offset +12) pointing to the ASCII DLL name string. This error is raised when that Name field is 0 in a descriptor that is not the all-zero terminator — a structure the PE spec forbids. The library throws it because it cannot record which DLL the descriptor refers to.","triggerScenarios":"imported_dlls(path) on a PE whose import descriptor array contains an entry with a zero Name RVA but non-zero other fields — caused by hand-edited headers, incomplete zeroing of a removed import, or fuzzed binaries.","commonSituations":"Import-stripping or import-hiding tools that blanked the Name field incorrectly; malware samples crafted to break parsers; a linker or post-processing tool bug that emitted a malformed descriptor; corrupt memory-mapped file edits.","solutions":["Open the binary with pefile / dumpbin /imports to confirm the import directory contains a descriptor with a zero Name field.","Rebuild the binary from source with a standard toolchain so the import table is emitted correctly.","If the malformed descriptor is intentional (import obfuscation), parse imports from a memory dump of the unpacked process instead.","Catch PeFormatError around imported_dlls and fail the check with a clear 'malformed import table' message for that artifact."],"exampleFix":"// before\nimports = imported_dlls(Path(binary_path))\n// after\ntry:\n    imports = imported_dlls(Path(binary_path))\nexcept PeFormatError as err:\n    print(f\"{binary_path}: malformed PE import table ({err})\")\n    imports = []","handlingStrategy":"validation","validationCode":"import pefile\n\ndef import_names_present(path) -> bool:\n    pe = pefile.PE(path)\n    for entry in getattr(pe, \"DIRECTORY_ENTRY_IMPORT\", []):\n        if not entry.dll:\n            return False\n    return True","typeGuard":null,"tryCatchPattern":"try:\n    imports = imported_dlls(path)\nexcept PeFormatError as err:\n    if \"no DLL name\" in str(err):\n        report_malformed_import_table(path, err)\n    else:\n        raise","preventionTips":["Reject binaries produced by import-stripping/obfuscation tools that leave zeroed Name fields.","Rebuild from source with a standard linker instead of patching PE headers by hand.","Cross-check with dumpbin /imports which reports malformed descriptors.","Keep a curated allowlist of trusted build pipelines for artifacts you validate."],"tags":["pe-format","import-table","binary-parsing","corrupt-file","python"],"backgroundTag":"pe-import-descriptor-missing-dll-name","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}