Don't compact raw data means keep the RawOffset/RawSize the same as VirutalOffset/VirutalSize.
Why?
In most case, we are researching the dumped file. Keep the same address/offset makes it easier to locate the data in hex editors, debuggers and other PE tools.
Of course, we can compact raw data giving a smaller final PE file.
Don't compact raw datameans keep theRawOffset/RawSizethe same asVirutalOffset/VirutalSize.Why? In most case, we are researching the dumped file. Keep the same address/offset makes it easier to locate the data in hex editors, debuggers and other PE tools. Of course, we can compact raw data giving a smaller final PE file.
Related code: https://github.com/NtQuery/Scylla/blob/0ca2c1a0da5dca4bf124cbc9ab127439b2b8c097/Scylla/PeParser.cpp#L1083-L1092 https://github.com/NtQuery/Scylla/search?q=alignAllSectionHeaders&unscoped_q=alignAllSectionHeaders