adjust_VirtualAddress is not correct

[GoogleCodeExporter]

def adjust_VirtualAddress( val, alignment ):
    # Alignment should, at least, be page-sized
    if alignment < 0x1000:
        alignment = 0x1000     # It's a BUG!
    if val % alignment:
        return alignment * ( val / alignment )
    return val

For example, try to parse ntoskrnl.exe ( Windows kernel ) - It has aligment 128 
bytes for sections.

I has commented this lines: 
#    if alignment < 0x1000:
#        alignment = 0x1000   
for getting list of import for ntoskrnl.exe

Original issue reported on code.google.com by tarasc0i...@gmail.com on 8 Feb 2011 at 9:00

[GoogleCodeExporter]

Thanks for bringing it to my attention. The last version of pefile has already 
been modified to handle unusual combinations of file and section alignments 
but, as you point out, still does not handle properly alignments as the ones in 
this file.

The proposed fix would work for this case but would break others. I will try to 
fix it generically.

Original comment by ero.carr...@gmail.com on 8 Feb 2011 at 9:56

• Changed state: Started

[GoogleCodeExporter]

Fixed in revision 95

Original comment by ero.carr...@gmail.com on 8 Feb 2011 at 6:25

• Changed state: Verified