In this post i will share something that may be considered as a bug in IDA. The bug is as follows:
If we manipulate the value of the “NumberOfSymbols” field in the “IMAGE_COFF_SYMBOLS_HEADER” structure, we can force IDA to abort processing the whole PE and quickly terminate.
When manipulating this field, just make sure to set a compatible value for the “SizeOfData” field in the “IMAGE_DEBUG_DIRECTORY” structure and also have a compatible file size by appending null bytes to the file end.
When calculating the required memory size for symbol entries using the spoofed value, IDA detects an overflow.