A .NET file is invalidly detected as mapped

hasherezade / libpeconv

A library to load, manipulate, dump PE files. See also: https://github.com/hasherezade/libpeconv_tpl

https://hasherezade.github.io/libpeconv

BSD 2-Clause "Simplified" License

1.07k stars 176 forks source link

Closed hasherezade closed 2 years ago

hasherezade commented 2 years ago

Example:

0f5a21b7179f3a8958a3bae8e9b9fb49220a708c4f6335459b0aa14c3a7cc937 - Formbook payload (with padding) The raw form of this file was invalidly detected as mapped.

The same payload without padding appended is detected as raw: