why the size of image is different from using get_memory_mapped_image

erocarrera / pefile

pefile is a Python module to read and work with PE (Portable Executable) files

MIT License

1.88k stars 522 forks source link

why the size of image is different from using get_memory_mapped_image #351

Open zjgcjy opened 2 years ago

zjgcjy commented 2 years ago

As I use mem = pe.get_memory_mapped_image() but the len(mem) does not equal to Size of Image defined in PE Optional header. The difference is 0x200. The environment is a x64 driver on windows 10.