Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #4  
Old 08-01-2006, 18:45
MarkusO
 
Posts: n/a
The reason for the bigger size of the dump is simple. If the file is on your HDD, a section can have a physical size of 0x4A00 and a virtual size of 0x9000.

When the section is loaded into memory, the dumper only knows the virtual size and dumps the full 0x9000 bytes. The dumper doesn't know if the 0x4A00 bytes contained compressed data or not, so it cannot use the physical size for dumping.

Of course you can set the physical size to 0x4A00 again after you have verified that only 0x4A00 bytes are really used and the other 0x4600 bytes are unused.
Reply With Quote
 

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Scylla x64/x86 Imports Reconstruction Killboy Community Tools 90 10-28-2024 03:42
KERNEL32 imports in IDA Pro pez General Discussion 9 08-27-2004 05:10
What Exports do i include in Wineice.dat for Win 2000?.. bunion General Discussion 2 08-22-2003 19:07
armkiller imports Akki General Discussion 1 12-30-2002 17:33


All times are GMT +8. The time now is 02:26.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )