gauntalt / corkami

Automatically exported from code.google.com/p/corkami
1 stars 0 forks source link

max_secW7.exe is not what it suggests #2

Closed GoogleCodeExporter closed 8 years ago

GoogleCodeExporter commented 8 years ago
In Windows7 (and afaik starting with Vista) the maximum number of sections is 
0xffff.

I've attached two files (32 and 64 bit) which have 0xffff sections. Some tools 
do break when trying to parse/load them.

It's the same limit for 64bit if you want to add that to the corpus.

They just have an endless loop at the entry point, but you can see in the task 
manager that they load and run.

pw (for both): "cleanfile"

Original issue reported on code.google.com by trandafi...@gmail.com on 28 Feb 2012 at 9:05

Attachments:

GoogleCodeExporter commented 8 years ago
maxsec is the maximum amount of sections that could be generated with Yasm.
however, 65535sects.exe already has 65535 sections and is included. it was 
generated via a manual python script.
check http://code.google.com/p/corkami/wiki/PE?show=content#NumberOfSections

Original comment by ange.alb...@gmail.com on 13 Mar 2012 at 2:37