![]() |
|
|
|
#1
|
|||
|
|||
|
Quote:
Quote:
Lord PE gives me the following section table ROffset 001000 => Code 214000 226000 => 0x4000 zeros in file 22A000 22E000 => 0x1000 zeros in file 22F000 => 0x1000 zeros in file 230000 231000 => 0x21000 zeros in file 252000 (.rsrc) 2EA000 (.data) 312000 (.adata) => 0x1000 zeros in file 313000 (.mackt) => contains IAT Now I'm not sure about those zero sections. Would it be possible to delete them? I imagine this: Delete, for example, those 0x4000 bytes at ROffset 226000, so file size decreases by 0x4000. The NumberOfSections becomes 11 instead of 12 and all ROffsets of the sections that come after the deleted one must be decreased by 0x4000. Would the PE loader be able to load the resulting file correctly? I don't know, because the 0x4000 bytes in memory at VA ImageBase+0x226000 are no longe initialized with zeros; this part of memory isn't even covered by the section table anymore. I think I should conduct some experiments... Regards Wurstgote |
![]() |
| Thread Tools | |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| one newbie question | SubzEro | General Discussion | 7 | 03-12-2015 06:05 |
| ASPR, ARMA question | sgdt | General Discussion | 3 | 04-09-2006 03:38 |
| ASPR 1.2 question | gabri3l | General Discussion | 42 | 05-01-2004 15:09 |
| a newbie question about CRC32 | abccc | General Discussion | 13 | 04-23-2004 03:13 |
| "newbie" question for crackers ;) | newbie007 | General Discussion | 4 | 10-07-2003 04:46 |