search

andyvand / pefile

Automatically exported from code.google.com/p/pefile
Other
0 stars 0 forks source link

Overlay detection for sectionless PE #51

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago 
What steps will reproduce the problem?
1. Download sectionless.exe from corkami or attachment
2. Execute
pe =  pefile.PE("sectionless.exe", fast_load=False)
print pe.get_overlay_data_start_offset()

What is the expected output? What do you see instead?

pefile shows an overlay offset of 0.
The output should be that there is no overlay. The file is in low-alignment 
mode and all of it is loaded to memory.

What version of the product are you using? On what operating system?

pefile 1.2.10-139 
Ubuntu 14.04

Please provide any additional information below.

Original issue reported on code.google.com by Struppi...@googlemail.com on 14 Sep 2014 at 8:56

Attachments:

GoogleCodeExporter commented 9 years ago

Original comment by ero.carr...@gmail.com on 27 Oct 2014 at 3:30