Fix cache_adjust_FileAlignment to work with files not aligned to 0x200

erocarrera / pefile

pefile is a Python module to read and work with PE (Portable Executable) files

MIT License

1.83k stars 516 forks source link

Fix cache_adjust_FileAlignment to work with files not aligned to 0x200 #397

Closed asivery closed 3 months ago

asivery commented 4 months ago

Hello, Please let me know if this isn't a bug, but the library definitely doesn't align PE files aligned to 0x1000 correctly, and this did fix that.

Best regards.

erocarrera commented 3 months ago

This did send me down quite a rabbit hole. It turns out that, for all I can see, Windows ignores the header's FIleAlignment value. The Windows loader aligns the PointerToRawData to 512 bytes (the "sector" size) when mapping the sections (512 often turns to be the default value of FileAlignment). But that's the only alignment that seems to be applied. I would be curious if anyone can find a working counter-example. I will revert the patch.

asivery commented 2 months ago

@erocarrera I understand what you mean. If you wish, I can provide you a copy of the file in question.

erocarrera commented 2 months ago

Hi @asivery , yes please, that'd be great!

asivery commented 2 months ago

@erocarrera Sorry for the delay, here you go: salwrap.zip