![]() |
|
#4
|
|||
|
|||
|
The reason for the bigger size of the dump is simple. If the file is on your HDD, a section can have a physical size of 0x4A00 and a virtual size of 0x9000.
When the section is loaded into memory, the dumper only knows the virtual size and dumps the full 0x9000 bytes. The dumper doesn't know if the 0x4A00 bytes contained compressed data or not, so it cannot use the physical size for dumping. Of course you can set the physical size to 0x4A00 again after you have verified that only 0x4A00 bytes are really used and the other 0x4600 bytes are unused. |
| Thread Tools | |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Scylla x64/x86 Imports Reconstruction | Killboy | Community Tools | 90 | 10-28-2024 03:42 |
| KERNEL32 imports in IDA Pro | pez | General Discussion | 9 | 08-27-2004 05:10 |
| What Exports do i include in Wineice.dat for Win 2000?.. | bunion | General Discussion | 2 | 08-22-2003 19:07 |
| armkiller imports | Akki | General Discussion | 1 | 12-30-2002 17:33 |