Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #5  
Old 09-28-2003, 17:13
amitophia
 
Posts: n/a
You can remove this sections manually


You have to remove this section from section list in PE-header an move up ther sections to fill up the gaps, so it would be like this (but you shouldn't change header size)

1000 .data
1000 .mackt
1000 .rdata
2000 .rsrc
1000 .text
10000 .tex1
Then you'll have to correct the Phys Address and RVA's.
If this sections were placed at the end of file.
This is needed only for sections that goes after removed sections. So If section .pdata were 600 phys bytes long (for example) then all other sections phys addresses will reduce by 600 bytes in the "removed" version.
The RVA's need to be corrected to fill the RVA gaps (because win2k and XP (maybe, NT) don't allow the holes betweebn sections)
So you have to increase RVA size of sections to the beginning of next section.

Last edited by amitophia; 09-29-2003 at 05:41.
Reply With Quote
 

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Instruction Size visu General Discussion 9 05-16-2005 18:23
10 lines code dumped themida pll823 General Discussion 3 04-23-2005 17:36
Dumped File / DLL Missing rf1911 General Discussion 7 08-24-2003 06:19


All times are GMT +8. The time now is 18:21.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )