You can easily confirm this bug if you try to verify the page hashes for the C:\Windows\SysWOW64\kernel32.dll file on Windows 10, which uses the section alignment 0x10000, but the real page size is 0x1000:
You should look at the image file header machine field. If it is IA64 (0x200), Alpha AXP (0x184) or Alpha AXP x64 (0x284), then the page size is 8K. Otherwise, the page size is 4K.
The software incorrectly computes the page hashes for PE files. It uses the section alignment as a memory page size, which is incorrect. Instead, real architecture page size should be used: https://devblogs.microsoft.com/oldnewthing/20210510-00/?p=105200.
You can easily confirm this bug if you try to verify the page hashes for the
C:\Windows\SysWOW64\kernel32.dll
file on Windows 10, which uses the section alignment0x10000
, but the real page size is0x1000
:You should look at the image file header
machine
field. If it isIA64
(0x200
), Alpha AXP (0x184
) or Alpha AXP x64 (0x284
), then the page size is 8K. Otherwise, the page size is 4K.