search

erocarrera / pefile

pefile is a Python module to read and work with PE (Portable Executable) files
MIT License
1.83k stars 516 forks source link

Problem with overlay and clipped executables #378

Open im-overlord04 opened 12 months ago

im-overlord04 commented 12 months ago

Hello,

I noticed that if I take a valid PE file without overlay and I remove a single byte from the end, the methods get_overlay() and get_overlay_data_start_offset won't return None but wrong values. This can be extended to all the valid PE that have been eventually clipped.